lgtm,codescanning
* The `js/tainted-path` now recognizes the `mkdirp` library as a sink.
  Affected packages are
    [mkdirp](https://www.npmjs.com/package/mkdirp)