Details here: https://snyk.io/vuln/npm:moment:20161019
It takes just a 40 characters long string to block the event loop for about 20 seconds on a standard laptop, while each additional space character will double that time.
Example: moment-test.js
var m = require("moment");
m.locale("be");
m().format("D MMN MMMM");