lgtm,codescanning

• Paths used with the resolve command are seen as sinks for the js/path-injection query. Affected packages are resolve