lgtm,codescanning The js/tainted-path now recognizes the mkdirp library as a sink. Affected packages are mkdirp