Kubernetes dev

[poornima-metron]

No description provided.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@jupiterone/integration-sdk-core@12.8.3	environment Transitive: eval, unsafe	+9	5.67 MB	jupiterone-dev
npm/@jupiterone/integration-sdk-dev-tools@12.8.3	Transitive: environment, eval, filesystem, network, shell, unsafe	+476	105 MB	jupiterone-dev
npm/@jupiterone/integration-sdk-testing@12.8.3	environment Transitive: eval, filesystem, network, shell, unsafe	+181	27 MB	jupiterone-dev
npm/@types/node@20.14.5	None	+1	2.16 MB	types

🚮 Removed packages: npm/@ampproject/remapping@2.2.0, npm/@babel/code-frame@7.12.11, npm/@babel/compat-data@7.13.15, npm/@babel/core@7.13.16, npm/@babel/generator@7.13.16, npm/@babel/helper-compilation-targets@7.13.16, npm/@babel/helper-environment-visitor@7.18.9, npm/@babel/helper-function-name@7.12.13, npm/@babel/helper-hoist-variables@7.18.6, npm/@babel/helper-module-imports@7.13.12, npm/@babel/helper-module-transforms@7.13.14, npm/@babel/helper-plugin-utils@7.13.0, npm/@babel/helper-simple-access@7.13.12, npm/@babel/helper-split-export-declaration@7.12.13, npm/@babel/helper-validator-option@7.12.17, npm/@babel/helpers@7.13.17, npm/@babel/highlight@7.13.10, npm/@babel/parser@7.13.16, npm/@babel/template@7.12.13, npm/@babel/traverse@7.13.17, npm/@babel/types@7.13.17, npm/@jridgewell/gen-mapping@0.1.1, npm/@jridgewell/set-array@1.1.2, npm/@jupiterone/integration-sdk-core@8.22.6, npm/@jupiterone/integration-sdk-dev-tools@8.22.6, npm/@jupiterone/integration-sdk-testing@8.22.6, npm/@nodelib/fs.stat@2.0.4, npm/@types/babel__core@7.1.19, npm/@types/babel__traverse@7.11.1, npm/@types/istanbul-lib-coverage@2.0.3, npm/@types/node@20.11.0, npm/abab@2.0.5, npm/acorn@7.4.1, npm/ajv@8.2.0, npm/body-parser@1.19.0, npm/braces@3.0.2, npm/browserslist@4.16.5, npm/caniuse-lite@1.0.30001219, npm/convert-source-map@1.7.0, npm/debug@4.3.1, npm/deep-is@0.1.3, npm/electron-to-chromium@1.3.723, npm/enquirer@2.3.6, npm/eslint-scope@5.1.1, npm/eslint-utils@2.1.0, npm/espree@7.3.1, npm/glob@7.1.6, npm/globby@11.0.3, npm/graceful-fs@4.2.6, npm/http-errors@1.7.2, npm/ieee754@1.1.13, npm/is-glob@4.0.1, npm/istanbul-lib-instrument@5.2.0, npm/jest-matcher-utils@27.5.1, npm/jest-util@27.5.1, npm/json5@2.2.0, npm/micromatch@4.0.4, npm/mime-db@1.47.0, npm/mime-types@2.1.30, npm/minimatch@3.0.4, npm/moment@2.29.1, npm/node-releases@1.1.71, npm/picocolors@1.0.0, npm/picomatch@2.2.3, npm/pretty-format@27.5.1, npm/psl@1.8.0, npm/punycode@2.1.1, npm/regexpp@3.1.0, npm/sax@1.2.1, npm/semver@7.3.5, npm/source-map-support@0.5.19, npm/statuses@1.5.0, npm/string-width@4.2.2, npm/update-browserslist-db@1.0.5, npm/whatwg-url@8.5.0, npm/word-wrap@1.2.3, npm/yargs-parser@20.2.7

View full report↗︎

[suraj-metron]

Can we try to import only relevant functions ?

[poornima-metron]

imported only relevant

[suraj-metron]

Same as previous

[poornima-metron]

imported only relevant

[suraj-metron]

why this hardcoded value? Can we move it to constants?

[poornima-metron]

removed as not needed

[suraj-metron]

Please update all packages to latest version. Check the armis for reference

[poornima-metron]

updated to latest

[boostsecurity-io]

⚠️  5 New Security Findings

The latest commit contains 5 new security findings.

Findings
Dependency: npm / hawk@ 3.1.3 Vulnerability Information Vulnerability Severity CVSS EPSS Affected Versions Fixed Versions Contains Malware Description CVE-2022-29167 Critical 7.4 0.08% 9.0.1 no Uncontrolled Resource Consumption in Hawk
Dependency Location https://github.com/JupiterOne/graph-kubernetes/blob/d83571bcb4aaa5859e254eb4a100aabea59ed787/yarn.lock
Dependency: npm / hoek@ 2.16.3 Vulnerability Information Vulnerability Severity CVSS EPSS Affected Versions Fixed Versions Contains Malware Description CVE-2018-3728 Critical 8.8 1.02% 5.0.3 4.2.1 no Prototype Pollution in hoek CVE-2020-36604 Critical 8.1 0.22% 8.5.1 9.0.3 no hoek subject to prototype pollution via the clone function.
Dependency Location https://github.com/JupiterOne/graph-kubernetes/blob/d83571bcb4aaa5859e254eb4a100aabea59ed787/yarn.lock
Dependency: npm / npm@ 2.15.12 Vulnerability Information Vulnerability Severity CVSS EPSS Affected Versions Fixed Versions Contains Malware Description CVE-2018-7408 Critical 7.8 0.04% 5.7.1 no Incorrect Permission Assignment for Critical Resource in NPM CVE-2019-16775 Critical 7.7 0.18% 6.13.3 no Arbitrary File Write in npm CVE-2019-16776 Critical 7.7 0.11% 6.13.3 no npm symlink reference outside of node_modules CVE-2019-16777 Critical 7.7 0.19% 6.13.4 no npm Vulnerable to Global node_modules Binary Overwrite
Dependency Location https://github.com/JupiterOne/graph-kubernetes/blob/d83571bcb4aaa5859e254eb4a100aabea59ed787/yarn.lock
Dependency: npm / npm-user-validate@ 0.1.5 Vulnerability Information Vulnerability Severity CVSS EPSS Affected Versions Fixed Versions Contains Malware Description CVE-2020-7754 Critical 7.5 0.32% 1.0.1 no Regular expression denial of service in npm-user-validate
Dependency Location https://github.com/JupiterOne/graph-kubernetes/blob/d83571bcb4aaa5859e254eb4a100aabea59ed787/yarn.lock
Dependency: npm / tar@ 2.2.2 Vulnerability Information Vulnerability Severity CVSS EPSS Affected Versions Fixed Versions Contains Malware Description CVE-2021-32804 Critical 8.2 0.69% 3.2.2 4.4.14 5.0.6 6.1.1 no Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization CVE-2021-37713 Critical 8.2 0.07% 4.4.18 5.0.10 6.1.9 no Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Dependency Location https://github.com/JupiterOne/graph-kubernetes/blob/d83571bcb4aaa5859e254eb4a100aabea59ed787/yarn.lock

Not a finding? Ignore it by adding a comment on the line with just the word noboost.

Scanner: boostsecurity - BoostSecurity osv-scanner