title: Webpack security issue - css-loader
body: <p>So I've got a suuuuper basic webpack setup for a simple react app. I've been using css-loader to translate my CSS for webpack. But I'm getting a security warning... that seems to have no published solutions. </p>
  
  <p>Here is the warning: </p>
  
  <pre><code>│ Critical      │ Command Injection                                            │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Package       │ macaddress                                                   │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Patched in    │ No patch available                                           │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Dependency of │ css-loader [dev]                                             │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Path          │ css-loader &gt; cssnano &gt; postcss-filter-plugins &gt; uniqid &gt;     │
  │               │ macaddress                                                   │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ More info     │ https://nodesecurity.io/advisories/654      
  </code></pre>
  
  <p>As you can see, the issue is not webpack itself, but instead this macaddress package. I'm not sure what to do about this. It says it's "critical".... is there a fix for this? Could I use something other than css-loader? </p>
  
  <p>Here is my full webpack.config.js file: </p>
  
  <pre><code>const HtmlWebPackPlugin = require('html-webpack-plugin'); 
  
  module.exports={
      module: {
          rules: [
              {
                  test: /\.js$/, 
                  exclude: [
                      "/node_modules/",
                      "src/tests/"
                  ],  
                  use: {
                      loader: "babel-loader"
                  }
              }, 
              {
                  test: /\.scss$/,
                  use: [
                      {
                          loader: "style-loader" // creates style nodes for JS strings
                      }, 
                      {
                          loader: "css-loader" // translates CSS into CommonJS
                      }, 
                      {
                          loader: "sass-loader" // compiles Sass to CSS
                      }
                  ]
              },
              {
                  test: /\.html$/, 
                  use: [
                      { 
                          loader: "html-loader" 
                      }
                  ]
              }
  
          ]
      }, 
      plugins: [
          new HtmlWebPackPlugin({
              template: "./public/index.html", // where to read
              filename: "./index.html" // where to put code
          })
      ]
  }
  </code></pre>
  
  <p>I just want a working webpack setup with no security issues. Thanks in advance. </p>