Hi, looks like the package.json is using url-signature 1.0.4, which use a version of crypto-js with critical vulnerability. There is an opened issue in js-url-signature with a Pull Request, to update crypto-js version and solve the vulnerability.

googlemaps/js-url-signature#446

Thanks.