node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

[Sahil Lavingia]

[Ryan]

Looks like it's rooted in ethereum-waffle which is used by a few things...