Vulnerabilities in Yarn software