vscode-vsce references https://github.com/mysticatea/cpx which has known security vulnerabilities, which have been fixed in the repo, but the owner of the cpx is unresponsive and not releasing an update with the fixes. Can someone do something like clone the repo and reference the clone instead to fix this?