How to update npm nested dependency in node_modules due to vulnerability

Question

I'm using React (v17.0.2), with NodeJs (v16.14.0) and NPM (v8.5.1) and I've been using [email protected] in my project (it is listed as a dependency in package.json). The antd package has it's own dependencies as described in package-lock.json. One of these dependencies is [email protected].

An AWS vulnerability scan marked some issues with our project. Running an "npm audit" in our project resulted in 0 vulnerabilities listed. However after cloning the [email protected] project and running an "npm audit" from there the result was: 16 vulnerabilities (1 low, 4 moderate, 6 high, 5 critical)

It turns out that [email protected] has dependencies and/or sub dependencies that have vulnerabilities associated to it. Mostly or possibly all to do with outdated versions of packages used. However [email protected] is the latest version and the project doesn't appear to be particularly active (latest version was produced well over a year ago).

Solutions I thought to try were to use the "override" flag in package.json or npm-force-resolutions or "npm shrinkwrap". The problem is that the dependencies of copy-to-clipboard do not have their versions specified in package-lock.json. Instead these dependencies are defined in their own "lock" file located in node_modules/copy-to-clipboard/yarn.lock. These are not "lock" files that I have control over (i.e. they will be overwritten). Therefore I can't use any of those solutions.

I've created an issue with the copy-to-clipboard project to update their dependencies although it doesn't appear to be a particularly active project. So I don't know when that will happen if ever.

Swapping out antd for something else isn't really an option either.

What are my other options for trying to address this? Fork copy-to-clipboard to try and update the dependencies myself and hope I know what I'm doing? antd is widely used so I don't know how others aren't seeing this in their AWS (or whatever) vulnerability scans. Or perhaps they have solved this in a way that I haven't thought of.