Known vulnerabilities for package+version; normalized evidence, not a safety verdict. Base mainnet USDC