If you check on npmjs of this package (and indeed where this package backlinks to) you will find versions with a 17.x prefix <img width="769" height="523" alt="Image" src="https://github.com/user-attachments/assets/66927eb5-9cde-43da-884f-8a4342a254e0" /> Is this package compromised? there are no 17.x versions listed on the releases page