newer yarn versions are _less_ secure than the ancient/abandoned yarn 1? :(

Any links for further reading on security problems "under current maintainership"?