Report it privately through GitHub: open a security advisory. Do not open a public issue for it.

Include the package and version, the input that triggers the problem, and what happens. We reply in the advisory, and we credit you there unless you ask us not to.

Fixes go into the latest release of each package:

The npm packages in packages/ are in scope. The documentation site at https://northguild.dev/gmt/ is in scope too; report it the same way.