Address yarn audit script to audit base & patches

@tommasini is already working on this.

Since Jan 26, 2026.

due to a limitation in yarn patched packages (exg: lodash), we are not detecting audit issues in packages that are patched (meaning, audits never happened to patched packages, even to the original code version). (Sorry if I'm flagging a known issue!)Example:
There is a 
vulnerability
 in lodash between 4.0.0 and 4.17.22! Mobile app flagged this vulnerability, but since it's patched on the extension, it is not flagged there.PRs to address vulnerability:
Mobile PR
Extension PR (needs to be worked on)
Solution Proposal to start detecting audit issues in patched packages:
 Created this 
proposal Draft PR
 on extension. If we agree on a solution in this direction, it will be portable to any other repo as well (like mobile).
 I have added a meaningless title, commit name, and no PR description to minimize visibility on this for externals. Output of tests made on the Extension repo for patched packages (running 
yarn audit:patched --verbose --severity=moderate
)
======================================================================
📊 Audit Summary
======================================================================

⚠️ 12 package(s) with vulnerabilities:

• ethereumjs-util@7.1.5
🔵 4 low
• gulp-sourcemaps@3.0.0
🟡 3 moderate
📋 PostCSS line return parsing error
Severity: moderate
URL: https://github.com/advisories/GHSA-7fh5-64p2-3v2j
Affected: <8.4.31
Fix: Upgrade to gulp-sourcemaps@2.6.5

• watchify@4.0.0
🔵 4 low
• stylelint@13.6.1
🟡 9 moderate
📋 PostCSS line return parsing error
Severity: moderate
URL: https://github.com/advisories/GHSA-7fh5-64p2-3v2j
Affected: <8.4.31
Fix: Upgrade to stylelint@17.0.0

• @babel/runtime@7.25.9
🟡 1 moderate
📋 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
Severity: moderate
URL: https://github.com/advisories/GHSA-968p-4wvh-cqc8
Affected: <7.26.10
Fix: Upgrade to @babel/runtime@7.28.6

• @ledgerhq/hw-app-eth@6.42.2
🔵 8 low, 🟠 2 high
📋 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Severity: high
URL: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
📋 Axios is vulnerable to DoS attack through lack of data size check
Severity: high
URL: https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
Affected: 1.0.0 - 1.11.0
Fix: Upgrade to @ledgerhq/hw-app-eth@6.47.1

• @ledgerhq/evm-tools@1.3.0
🔵 6 low, 🟠 2 high
📋 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Severity: high
URL: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
📋 Axios is vulnerable to DoS attack through lack of data size check
Severity: high
URL: https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
Affected: 1.0.0 - 1.11.0
Fix: Upgrade to @ledgerhq/evm-tools@1.10.1

• lodash@4.17.21
🟡 1 moderate
📋 Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Severity: moderate
URL: https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
Affected: 4.0.0 - 4.17.21
Fix: Upgrade to lodash@4.17.23

• @metamask/jazzicon@2.0.0
🟡 3 moderate
📋 Regular Expression Denial of Service (ReDOS)
Severity: moderate
URL: https://github.com/advisories/GHSA-257v-vj4p-3w2h
Affected: <1.5.5
Fix available: No

• @metamask/bridge-controller@64.0.0
🔵 31 low
• @metamask/assets-controllers@93.1.0
🔵 29 low
• eth-lattice-keyring@0.12.4
🔵 8 low, 🟠 1 high, 🔴 3 critical
📋 Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
Severity: critical
URL: https://github.com/advisories/GHSA-vjh7-7g9h-fjfh
Affected: *
Fix: Upgrade to eth-lattice-keyring@1.1.0
📋 secp256k1-node allows private key extraction over ECDH
Severity: high
URL: https://github.com/advisories/GHSA-584q-6j8j-r5pm
Affected: >=2.0.0
Fix: Upgrade to eth-lattice-keyring@1.1.0