cross-env vulnerabilities — Scandar