Being a fork of the original request package, @cypress/request is vulnerable to CVE-2023-28155 (SSRF via insecure redirects). There is an issue and an open PR in the request repo, but the fix is unlikely to be merged since request is long abandoned. This fork is the second most popular fork, it would be great to have it patched.