[inbx0]

-name "*coa*" is a bit too eager. It will flag other packages too, like the fairly popular babel-plugin-nullish-coalescing

[resoluteteeth]

If you have an index for the locate command it's probably easier to do:

locate "/coa/package.json" | xargs -I {} jq .version {} 2>/dev/null

[salzig]

maybe print the command (`-t`) xargs executes, to make identification easier.

[resoluteteeth]

It's sort of a moot point since if you have an affected version you have to assume your whole system is compromised anyway in the case of this type of issue.