css-module-loader-core is very dead which is a problem as it depends on things like a 3 year old version of postcss (last 6.x version came out in 2018) which means you're pulling in things like a version of ansi-regex with security issues.

css-modules/css-modules-loader-core#231 (comment) provides some hints towards how others are solving this issue.