lgtm,codescanning
* Events from the [`serverless`](https://npmjs.com/package/serverless) package are recognized a source of remote user input.
  Affected packages are
    [serverless](https://npmjs.com/package/serverless)