We went ahead and released a version 4.1.0 on a separate project -- feel free to install that to cover and resolve any vulnerabilities

https://github.com/node-oauth/node-oauth2-server

See the changelog for what we did, we removed a lot of unneeded dependencies and updated dependencies that had vulnerabilities. 

You can still this version by running

`npm i @node-oauth/oauth2-server`, should just be a drop in replacement 