lgtm,codescanning
* Paths used with the [resolve](https://npmjs.com/package/resolve) command are seen as sinks for the `js/path-injection` query.
  Affected packages are
    [resolve](https://npmjs.com/package/resolve)