Version 1.2.6, which is the latest published, depends on an old version of rc-trigger, which transitively depends on deprecated core-js. That old version of core-js has extremely poor performance and a large number of vulnerabilities.
Please release a 1.2.7 with an updated reference to @rc-component/trigger.