Seems like the current version 0.2.3 depends on glob@3.2.11, which in turn depends on minimatch@0.3.0, which has a security issue. Current npm warns on install:
npm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
If possible, please use the latest glob library version.