Report it privately through GitHub's advisory form: https://github.com/GSTJ/react-native-code-push-plugin/security/advisories/new
Don't open a public issue for a security problem.
Fixes ship in a new release off the latest published version. Stay on it; there are no backport branches.