Denial of Service via Resource Exhaustion

A default that is not a guard: tinycolor2's palette functions never return on analogous(-1)

Two palette functions in a fifteen-year-old npm dependency exhaust the heap on a negative or fractional count. A differential fuzzer with 31 million comparisons could not see it.