SDK 4.0 NPM Vulnerabilities

[vincepg13]

Morning team,

I have noticed the vulnerabilities against my projects which make use of SDK 4.1.0 has been growing. Running an npm audit I get 15 vulnerabilites: 4 low, 8 moderate and 3 critical.

All of the vulnerabilities get traced back to @servicenow/sdk, please see the screenshot below.

Npm has had two large supply chain attacks in recent times, first with their maintaner accounts getting phished a few months back, and now with gitlab discovering potential Shai-Hulud malware propegating through the network a few days ago.

Given the context, I was wondering if we could expect an update to the SDK which addresses these vulnerabilities?

[bryce-godfrey]

Thanks @vincepg13 we do have a issue to update these on the next release, will prioritize it for a patch to do it sooner.

[bryce-godfrey]

We have released 4.1.1 which should address the high and critical vulnerabilities

[vincepg13]

Cheers mate, can confirm the critical ones are gone.