This package requires an old version of 'findup-sync' (3.0.0) that requires 'set-value' with old version (2.0.0) which has vulnerability issue.
Updating the package to require the latest version of 'findup-sync' will resolve the issue.
Thanks,
Michal.