diff --git a/javascript/ql/lib/ext/underscore.string.model.yml b/javascript/ql/lib/ext/underscore.string.model.yml
index 5f9dcf24946..d1330279f74 100644
--- a/javascript/ql/lib/ext/underscore.string.model.yml
+++ b/javascript/ql/lib/ext/underscore.string.model.yml
@@ -18,7 +18,7 @@ extensions:
       - ["'underscore.string'", "Member[toSentence,toSentenceSerial]", "Argument[0].ArrayElement", "ReturnValue", "taint"]
       - ["'underscore.string'", "Member[insert,replaceAll,splice,prune,pad,lpad,rpad,repeat,rjust,ljust]", "Argument[0,2]", "ReturnValue", "taint"]
       - ["'underscore.string'", "Member[splice]", "Argument[0,3]", "ReturnValue", "taint"]
-      - ["'underscore.string'", "Member[join]", "Argument[0..N-1]", "ReturnValue", "taint"]
+      - ["'underscore.string'", "Member[join]", "Argument[0..]", "ReturnValue", "taint"]
       - ["'underscore.string'", "Member[surround,quote,q]", "Argument[0,1]", "ReturnValue", "taint"]
       - ["'underscore.string'", "", "Argument[0]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[slugify,capitalize,decapitalize,clean,cleanDiacritics,swapCase,escapeHTML,unescapeHTML,wrap,dedent,reverse,pred,succ,titleize,camelize,classify,underscored,dasherize,humanize,trim,ltrim,rtrim,truncate,sprintf,strRight,strRightBack,strLeft,strLeftBack,stripTags,unquote,value,strip,lstrip,rstrip,camelcase]", "Argument[this]", "ReturnValue", "taint"]
@@ -26,9 +26,10 @@ extensions:
       - ["'underscore.string'.Wrapper", "Member[insert,replaceAll,prune,pad,lpad,rpad,repeat,rjust,ljust]", "Argument[1]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[surround,quote,q]", "Argument[0]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[splice]", "Argument[2]", "ReturnValue", "taint"]
-      - ["'underscore.string'.Wrapper", "Member[join,concat]", "Argument[0..N-1]", "ReturnValue", "taint"]
+      - ["'underscore.string'.Wrapper", "Member[join,concat]", "Argument[0..]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[toUpperCase,toLowerCase,replace,slice,substring,substr,split]", "Argument[this]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[tap]", "Argument[this]", "ReturnValue", "taint"]
       - ["'underscore.string'.Wrapper", "Member[tap]", "Argument[0].ReturnValue", "ReturnValue", "taint"]
+      - ["'underscore.string'.Wrapper", "Member[tap]", "Argument[this]", "Argument[0].Parameter[1]", "taint"]
       - ["'underscore.string'", "Member[map]", "Argument[0]", "Argument[1].Parameter[0]", "taint"]
       - ["'underscore.string'", "Member[map]", "Argument[1].ReturnValue", "ReturnValue", "taint"]
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/UnderscoreDotString.qll b/javascript/ql/lib/semmle/javascript/frameworks/UnderscoreDotString.qll
index 9e30dc38404..abb51b978bc 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/UnderscoreDotString.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/UnderscoreDotString.qll
@@ -10,7 +10,8 @@ private import semmle.javascript.dataflow.internal.AdditionalFlowInternal
  */
 private class UnderscoreDotString extends AdditionalFlowInternal {
   /**
-   * Holds if a call to an Underscore.string method clears array element content of the receiver.
+   * Some of the methods in `underscore.string` have the same name as methods from `Array.prototype`.
+   * This prevents methods like `splice` from propagating into Argument[this].ArrayElement.
    */
   override predicate clearsContent(DataFlow::Node node, DataFlow::ContentSet contents) {
     exists(DataFlow::CallNode call |