fix: avoid security warning for node-fetch

[doubleface]

For this, I use the cross-fetch package instead of isomorphic-fetch which is not maintained anymore Both are supposed to have the same behavior