Package: node-locate-character Version: 2.0.5-1 Severity: serious Justification: source-is-missing
2.0.5 is packaged from npm registry temporarily to be able to build rollup 2. Upstream didn't push 2.0.5 source in git repo (last github release/HEAD is 2.0.1), then 2.0.5 was packaged from npm registry instead. This bug is a reminder to avoid having 2.0.5-1 pushed outside experimental