add local flow when recognizing Object.assign calls for library-inputs

javascript/ql/lib/semmle/javascript/PackageExports.qll

@@ -200,7 +200,9 @@ private DataFlow::Node getAValueExportedByPackage() {
   or
   // Object.assign and friends
   exists(ExtendCall assign |
-    getAValueExportedByPackage() = [assign, assign.getDestinationOperand()] and
+    getAValueExportedByPackage() =
+      [assign, assign.getDestinationOperand(), assign.getDestinationOperand().getALocalSource()]
+  |
     result = assign.getASourceOperand()
   )
   or