GitHub has to review the advisories and publish it for it to show in `npm audit`, so it's delayed.