High security vulnerability reported due to dependency on decompress

As reported by `npm audit`:

```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Arbitrary File Write │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ decompress │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ bin-wrapper > download > decompress │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1217 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

Start by reproducing the reported `npm audit` finding and tracing the dependency path `bin-wrapper > download > decompress`, with the advisory at npmjs.com/advisories/1217 as context. Determine a supported remediation for the vulnerable dependency and verify that the audit no longer reports the high-severity arbitrary file write.

Written by the indexing model from the issue text.