update security alerts per devskim

[YingXue]

update security alerts per devskim scan

General Guidelines

• [x] If introducing new functionality or modified behavior, are they backed by unit tests?
• [x] Have all unit tests passed locally? (by running npm run test command)
• [x] Have you updated the README.md with new screenshots if significant changes have been made?
• [x] Have you update the package version if the current version in package.json is not higher than the version released?