Do not open a public issue for an undisclosed vulnerability. Use GitHub's private vulnerability reporting for alexandroit/stackline-loader-utils.

Include the affected version, runtime, minimal reproduction, impact and any known mitigation. Reports are acknowledged as soon as practical and coordinated disclosure is preferred.

The published package has two exact production dependencies, emojis-list@3.0.0 and json5@2.2.3. Both are current npm versions, have zero dependencies and have current non-archived upstream repositories. Maintenance evidence and review expiry are recorded in DEPENDENCY_REVIEW.md. Every release gate performs clean-install, recursive tree, license inventory and npm advisory checks.

The public contract follows loader-utils@2.0.4. Linear-time URL/hash internals and the upstream ReDoS correction from the later 3.2.1 line were ported without changing 2.0.4 outputs. Query helpers reject __proto__, prototype and constructor. Regression coverage exercises multi-megabyte malformed input under a hard process deadline and verifies that attacker-shaped objects do not mutate Object.prototype.

User-provided options.regExp is executable regular-expression configuration and should only be supplied by trusted loader configuration, matching the upstream contract.