open-source package vulnerabilities