npm 8.12 changes never merged into 3.16 stable
Commit 084d5d5d was merged to master on 6th June 2022 containing an update to npm version 8.12.1
This wasn't picked over to any 3.16 branch so the version of npm available (8.10) carries CVE-2022-25881, CVE-2022-25883 and CVE-2022-29244 which were all fixed in the 8.11 release