diff --git a/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/.snyk b/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/.snyk
new file mode 100644
index 0000000000..a57b0d0024
--- /dev/null
+++ b/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/.snyk
@@ -0,0 +1,80 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  'npm:debug:20170905':
+    - zuul > compression > debug:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > istanbul-middleware > body-parser > debug:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > debug:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:hawk:20160119':
+    - zuul > wd > request > hawk:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:http-signature:20150122':
+    - zuul > wd > request > http-signature:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:lodash:20180130':
+    - zuul > lodash:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:mime:20170907':
+    - zuul > express > send > mime:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > express > connect > send > mime:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > wd > request > form-data > mime:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > zuul-localtunnel > localtunnel > request > mime:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > zuul-localtunnel > localtunnel > request > form-data > mime:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:minimatch:20160620':
+    - zuul > istanbul-middleware > archiver > glob > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > browserify-istanbul > istanbul > fileset > glob > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > firefox-profile > archiver > file-utils > glob > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > firefox-profile > archiver > file-utils > findup-sync > glob > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > browserify-istanbul > istanbul > fileset > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > browserify-istanbul > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > firefox-profile > archiver > file-utils > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > wd > archiver > glob > minimatch:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:ms:20170412':
+    - zuul > compression > debug > ms:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > istanbul-middleware > body-parser > debug > ms:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:ms:20151024':
+    - zuul > debug > ms:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:negotiator:20160616':
+    - zuul > compression > accepts > negotiator:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > express > connect > negotiator:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:qs:20140806-1':
+    - zuul > express > connect > qs:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > superagent > qs:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:request:20160119':
+    - zuul > wd > request:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > zuul-localtunnel > localtunnel > request:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:tunnel-agent:20170305':
+    - zuul > wd > request > tunnel-agent:
+        patched: '2023-04-26T18:49:00.648Z'
+  'npm:uglify-js:20151024':
+    - zuul > hbs > handlebars > uglify-js:
+        patched: '2023-04-26T18:49:00.648Z'
+    - zuul > browserify-istanbul > istanbul > handlebars > uglify-js:
+        patched: '2023-04-26T18:49:00.648Z'
diff --git a/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/package.json b/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/package.json
index a447b9f1f8..86f599334a 100644
--- a/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/package.json
+++ b/test/fixtures/qs-package/node_modules/read-all-stream/node_modules/readable-stream/package.json
@@ -59,15 +59,16 @@
     "isarray": "~1.0.0",
     "process-nextick-args": "~1.0.6",
     "string_decoder": "~0.10.x",
-    "util-deprecate": "~1.0.1"
+    "util-deprecate": "~1.0.1",
+    "@snyk/protect": "latest"
   },
   "description": "Streams3, a user-land copy of the stream library from Node.js",
   "devDependencies": {
     "assert": "~1.4.0",
-    "nyc": "^6.4.0",
-    "tap": "~0.7.1",
+    "nyc": "^14.0.0",
+    "tap": "~1.0.8",
     "tape": "~4.5.1",
-    "zuul": "~3.9.0",
+    "zuul": "~3.12.0",
     "zuul-ngrok": "^4.0.0"
   },
   "directories": {},
@@ -120,7 +121,10 @@
     "local": "zuul --local -- test/browser.js",
     "report": "nyc report --reporter=lcov",
     "test": "tap test/parallel/*.js test/ours/*.js",
-    "write-zuul": "printf \"ui: tape\ntunnel: ngrok\nbrowsers:\n  - name: $BROWSER_NAME\n    version: $BROWSER_VERSION\n\">.zuul.yml"
+    "write-zuul": "printf \"ui: tape\ntunnel: ngrok\nbrowsers:\n  - name: $BROWSER_NAME\n    version: $BROWSER_VERSION\n\">.zuul.yml",
+    "prepublish": "npm run snyk-protect",
+    "snyk-protect": "snyk-protect"
   },
-  "version": "2.1.4"
+  "version": "2.1.4",
+  "snyk": true
 }