upgrade @jupiterone/data-model to 0.61.10

[RonaldEAM]

No description provided.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@jupiterone/[email protected]	None	+2	3.72 MB	jupiterone-dev

🚮 Removed packages: npm/@jupiterone/[email protected])

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code fragment contains a potential security risk due to the lack of input validation and sanitization for the 'cmd' argument, which could lead to command injection vulnerabilities. Confidence: 0.75 Severity: 0.60	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The presence of eval() in the code poses a significant security risk and potential for malicious behavior. Its usage should be reviewed and removed to mitigate the risk. Confidence: 0.42 Severity: 0.90	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code exhibits potential security risks, including data leakage, code injection vulnerabilities, and potential obfuscation. It should be refactored to use safer alternatives and undergo a thorough security review. Confidence: 0.75 Severity: 0.60	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code contains a security risk due to the use of the 'eval' function, which could lead to code injection and other vulnerabilities. The presence of 'eval' raises concerns about the security of the package. Confidence: 0.75 Severity: 0.70	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code is vulnerable to command injection and arbitrary code execution due to the lack of input validation and sanitization, which could be exploited by an attacker to execute arbitrary shell commands on the host system. The use of 'vm' module for executing untrusted code should be reviewed and potentially removed to mitigate the risk of arbitrary code execution. Confidence: 0.80 Severity: 0.80	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The presence of the eval function in the code raises serious security concerns as it can execute arbitrary code and lead to potential unauthorized actions or data theft. The code should be reviewed and the use of eval should be carefully reconsidered. Confidence: 0.45 Severity: 0.85	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code contains a significant security risk due to the 'exec' function executing shell commands based on untrusted input. This could lead to command injection attacks and unauthorized system access. Immediate action should be taken to address this security issue. Confidence: 0.45 Severity: 0.85	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code should be refactored to remove the use of 'eval', properly sanitize and validate user input, and carefully review and secure the usage of environment variables and constructed objects to prevent potential security risks. The identified issues pose a high security risk and require immediate attention. Confidence: 0.75 Severity: 0.75	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
Obfuscated code	npm/@jupiterone/[email protected]	Confidence: 0.90 Location: Package overview	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	⚠︎
AI detected security risk	npm/@jupiterone/[email protected]	Notes: The code contains a significant security risk due to the use of the 'eval' function, which can lead to code injection vulnerabilities. This behavior is highly risky and should be addressed immediately. Confidence: 0.42 Severity: 0.90	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫
AI detected security risk	npm/@jupiterone/[email protected]	Notes: Due to the lack of code for analysis, the reports are inconclusive and do not provide any meaningful insights into the security of the open source dependency. The high confidence level in report 5 contradicts the absence of scores for malware, security risk, and obfuscated, indicating inconsistencies in the reporting. Without code review, it is challenging to make accurate assessments of the security risks associated with the software. Confidence: 0.40 Severity: 0.40	package-lock.json packages/integration-sdk-cli/package.json packages/integration-sdk-core/package.json packages/integration-sdk-entities/package.json	🚫

View full report↗︎

Next steps

What are AI-detected potential security risks?

AI has determined that this package may contain potential security issues or vulnerabilities.

An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

What is obfuscated code?

Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware.

Packages should not obfuscate their code. Consider not using packages with obfuscated code

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/@jupiterone/[email protected]