Critical Severity Vulnerability in intersection-observer

We actually want to use mdxeditor, which uses @react-hook/intersection-observer.

However, we have now been informed that the intersection-observer contained therein is highly vulnerable.

Since the intersection observer is a polyfill and has not been developed further since 2022, I wanted to ask if you could offer a new version without this polyfill or to replace it with another, see below.

It should now be usable by all modern browsers even without polyfill.
https://caniuse.com/?search=IntersectionObserver

Vulnerability info:

A malicious Polyfill reference has been identified in this package. The issue is located in the file "package\intersection-observer-test.html".
To address this security concern, we recommend taking one of two actions: either remove the affected file completely or replace the suspicious reference with a trusted alternative. Reliable Polyfill sources include Cloudflare (https://cdnjs.cloudflare.com/polyfill) and Fastly (https://community.fastly.com/t/new-options-for-polyfill-io-users/2540).
Mend Note: For more detailed information about the Polyfill supply chain attack and its widespread impact, you can refer to our comprehensive blog post at https://www.mend.io/blog/more-than-100k-sites-impacted-by-polyfill-supply-chain-attack/.

Publish Date: 2024-07-04

Start by inspecting package/intersection-observer-test.html, the file identified as containing the malicious polyfill reference. Confirm whether the package still needs the IntersectionObserver polyfill for modern browsers, then remove the affected file or replace the reference with a trusted alternative. Done means the vulnerable reference is no longer shipped and the package remains usable by its consumers.

Written by the indexing model from the issue text.