A security issue was raised on CVE-2021-21366 regarding misinterpretation of malicious XML input  https://www.npmjs.com/advisories/1650 Updating to 0.5.0 resolves the problem.