Package security questions

Really liking the editor so far, but we noticed a few security warnings on socket.dev that we had some questions about:
https://socket.dev/npm/package/@editorjs/editorjs

Wondering if anyone could speak to the issues of [zero width unicode chars](https://socket.dev/npm/issue/zeroWidth) and [uses eval](https://socket.dev/npm/issue/usesEval) that it found and the necessity of those two things within the package.

Thank you!