editor-layer-index at npm was taken down, claimed to be containing malware, npm audit gives scary warning on install #10772

As I understand: at some point https://www.npmjs.com/package/editor-layer-index was taken down. Maybe it actually had malware.

https://github.com/openstreetmap/iD/blob/develop/package.json#L101C28-L101C69 points not to NPM but to github

"editor-layer-index": "github:osmlab/editor-layer-index#gh-pages",

but npm audit does npm audit things and emits scary warning linking GHSA-jq9w-gjvg-mxr8

Is it avoidable somehow? It is definitely scary for new contributors