false-positive on multiple packages

[CHATSKII]

Seems like packages were held as a security placeholder for some time and then packages names were properly claimed as "Holding package". Since then packages do not appear to be malicious (since the last update).

References:

• GHSA-gjfj-qv3p-9q4w
• GHSA-mp9m-cqg8-m2qw

Additional info from npmjs:

https://www.npmjs.com/package/@cobalt-team/support-email
https://www.npmjs.com/package/@cobalt-team/multi-invite

[shelbyc]

Hi @CHATSKII, I changed GHSA-gjfj-qv3p-9q4w and GHSA-mp9m-cqg8-m2qw to have vulnerable version ranges of < 1.0.1 to avoid the non-malicious version(s).