path-parse has a dependency in version 1.0.6: https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067  A fix would be to upgrade react-loading-overlay to the new version of emotion(https://www.npmjs.com/package/emotion) which doesn't depend on anything.