It was actually reported on (or before) Jan 3rd.

See https://security.snyk.io/vuln/SNYK-JS-EXTEND2-2320315 .