@mttaggart so, there is a real reason to be very concerned here.

a metric ton of vibed apps are on node and all aren't in "vercel" (et al.) that will get auto-patched.

alot of those apps are not going to see an update either at all or for a while, and it's unlikely the vibes pinned `@latest` for versions.

a cpl more of these type of vulns and it's gonna be wild out there.