A high severity vulnerability has been found in a widely used npm package "extend2" with over 46K weekly downloads.