search

JupiterOne / sdk

Home of the JupiterOne SDK
Mozilla Public License 2.0
20 stars 16 forks source link

upgrade @jupiterone/data-model to 0.61.10 #1114

Closed RonaldEAM closed 1 month ago

socket-security[bot] commented 1 month ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@jupiterone/data-model@0.61.10 None +2 3.72 MB jupiterone-dev

🚮 Removed packages: npm/@jupiterone/data-model@0.61.9)

View full report↗︎

socket-security[bot] commented 1 month ago

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code fragment contains a potential security risk due to the lack of input validation and sanitization for the 'cmd' argument, which could lead to command injection vulnerabilities.
  • Confidence: 0.75
  • Severity: 0.60
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The presence of eval() in the code poses a significant security risk and potential for malicious behavior. Its usage should be reviewed and removed to mitigate the risk.
  • Confidence: 0.42
  • Severity: 0.90
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code exhibits potential security risks, including data leakage, code injection vulnerabilities, and potential obfuscation. It should be refactored to use safer alternatives and undergo a thorough security review.
  • Confidence: 0.75
  • Severity: 0.60
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code contains a security risk due to the use of the 'eval' function, which could lead to code injection and other vulnerabilities. The presence of 'eval' raises concerns about the security of the package.
  • Confidence: 0.75
  • Severity: 0.70
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code is vulnerable to command injection and arbitrary code execution due to the lack of input validation and sanitization, which could be exploited by an attacker to execute arbitrary shell commands on the host system. The use of 'vm' module for executing untrusted code should be reviewed and potentially removed to mitigate the risk of arbitrary code execution.
  • Confidence: 0.80
  • Severity: 0.80
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The presence of the eval function in the code raises serious security concerns as it can execute arbitrary code and lead to potential unauthorized actions or data theft. The code should be reviewed and the use of eval should be carefully reconsidered.
  • Confidence: 0.45
  • Severity: 0.85
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code contains a significant security risk due to the 'exec' function executing shell commands based on untrusted input. This could lead to command injection attacks and unauthorized system access. Immediate action should be taken to address this security issue.
  • Confidence: 0.45
  • Severity: 0.85
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code should be refactored to remove the use of 'eval', properly sanitize and validate user input, and carefully review and secure the usage of environment variables and constructed objects to prevent potential security risks. The identified issues pose a high security risk and require immediate attention.
  • Confidence: 0.75
  • Severity: 0.75
 🚫
Obfuscated code npm/@jupiterone/data-model@0.61.10 ⚠︎
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: The code contains a significant security risk due to the use of the 'eval' function, which can lead to code injection vulnerabilities. This behavior is highly risky and should be addressed immediately.
  • Confidence: 0.42
  • Severity: 0.90
 🚫
AI detected security risk npm/@jupiterone/data-model@0.61.10
  • Notes: Due to the lack of code for analysis, the reports are inconclusive and do not provide any meaningful insights into the security of the open source dependency. The high confidence level in report 5 contradicts the absence of scores for malware, security risk, and obfuscated, indicating inconsistencies in the reporting. Without code review, it is challenging to make accurate assessments of the security risks associated with the software.
  • Confidence: 0.40
  • Severity: 0.40
 🚫

View full report↗︎

Next steps

What are AI-detected potential security risks?

AI has determined that this package may contain potential security issues or vulnerabilities.

An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

What is obfuscated code?

Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware.

Packages should not obfuscate their code. Consider not using packages with obfuscated code

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/@jupiterone/data-model@0.61.10