[Bug]: Replacing the discontinued vcritically vulnerable vm2 NPM package #6387

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: Latest Firefox
• Local OS: Latest Ubuntu LTS
• Remote OS: Latest Ubuntu LTS
• Remote Architecture: amd64
• code-server --version: v4.16.1

Steps to Reproduce

Critical vulnerabilities can be detected using the latest Anchore Grype scanner (from the official anchore/grype:latest container) in the vm2 node module used in v4.16.1 of code-server:

vm2                               3.9.19                   GHSA-cchq-frgv-rjh5  Critical   /usr/lib/code-server/node_modules/vm2/package.json
vm2                               3.9.19                   GHSA-g644-9gfx-q4q4  Critical   /usr/lib/code-server/node_modules/vm2/package.json

Due to them the vm2 NPM package has been discontinued: patriksimek/vm2#533

Expected

Replacing this vulnerable vm2 package, e.g. with https://www.npmjs.com/package/isolated-vm, a package which is deemed by the vm2 vulnerability reporter as safe, and also reportedly - according to the same source - Spotify made such a transition (see: patriksimek/vm2#533 (comment)).

Actual

vm2 binary is still being used:

$ ls -lant /usr/lib/code-server/node_modules/vm2/bin/vm2 
-rwxr-xr-x 1 0 0 59 Jul 31 18:58 /usr/lib/code-server/node_modules/vm2/bin/vm2

Logs

No response

Screenshot/Video

No response

Does this issue happen in VS Code or GitHub Codespaces?

• I cannot reproduce this in VS Code.
• I cannot reproduce this in GitHub Codespaces.

Are you accessing code-server over HTTPS?

• I am using HTTPS.

Notes

No response