Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

11–20 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#11

Post by myth_drannon »

RHSeeger wrote: post #9
myth_drannon wrote: post #8

Earlier quoted context omitted.

[flagged]

They just recently snuck bombs into a supply chain and then remotely detonated them in positions where the caused civilian injuries. I would assume the comment has nothing to do with religion/race, and everything to do with the actions taken. Even for someone that is a supporter of that government, it's hard to deny they've taken some actions that are unsupportable.

How the hell that is connected to a private software company?

Nvidia, Google, Microsoft, Intel is full of ex-8200.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#12

Post by nullityrofl »

CuriouslyC wrote: post #6
kstrauser wrote: post #5

Earlier quoted context omitted.

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

Maybe if you change that to "armed bodyguard services employ ex KGB assassins"

I think you've missed the point: it's Americentric to assume that Navy SEALs and Army Rangers are inherently pure, good and have done nothing evil on behalf of the American government when we largely know that to be untrue.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#13

Post by lolinder »

RHSeeger wrote: post #9
myth_drannon wrote: post #8

Earlier quoted context omitted.

[flagged]

They just recently snuck bombs into a supply chain and then remotely detonated them in positions where the caused civilian injuries. I would assume the comment has nothing to do with religion/race, and everything to do with the actions taken. Even for someone that is a supporter of that government, it's hard to deny they've taken some actions that are unsupportable.

Who is "they"? Are we talking about Snyk? IDF Unit 8200? The IDF as a whole? The state of Israel? Jews in general?

The reason why OP's comment feels like a racist dog whistle is because it's an enormous and dangerous generalization that seems to encompass an entire country. Israel has mandatory military service—if everyone who's ever served in the IDF is untrustworthy because they served in the IDF then you're by definition excluding nearly every Israeli citizen from trust. I guess that's not strictly antisemitism—maybe you're happy to trust Jews that don't live in Israel—but it's definitely an unsavory position to take.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#14

Post by lolinder »

PessimalDecimal wrote: post #10
myth_drannon wrote: post #8

Earlier quoted context omitted.

[flagged]

This is a tiresome motte-and-bailey argument. You are trying to conflate the OP comment with something it's not (base antisemitism). Just like companies founded by say former operatives of the CIA, NSA, MI6, etc. would (and maybe should?) be viewed with skepticism, so too are companies founded by former members of Unit 8200. Mentioning that Israel's military (like many others) has engaged in some less than ethical be…

Israel has mandatory military service. If anyone who has ever served in the IDF is tarnished and has that part of their life periodically dragged out as evidence that they may be untrustworthy, you're saying that the entire Jewish population of the state of Israel needs to have a giant asterisk attached to them reminding everyone that they were in the IDF.

That may not be strictly antisemitic—maybe you're totally fine with Jews as long as they were raised anywhere else—but it's still not a healthy way to treat people.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#15

Post by n2d4 »

[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them]

Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0].

Assumably, this Snyk employee either found or suspected that some part of Cursor's build is misconfigured as above, and uploaded those packages as a POC. (Given the package description "for Cursor", I'd think they were hired for this purpose.)

If that's the case, then there's not much to see here. The security researcher couldn't have used a private NPM registry to perform the POC if the point is to demonstrate a misconfiguration which skips the private registry.

.

[0] In particular, many proxies will choose the public over the private registry if the latest package version is higher: https://snyk.io/blog/detect-prevent-dependency-confusion-att...

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#16

Post by tru3_power »

woodruffw wrote: post #2

Without more context, this doesn't look great for Snyk either way: either they have an employee using NPM to live test their own services, or they have insufficient controls/processes for performing a legitimate audit of Cursor without using public resources.

Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#18

Post by lopkeny12ko »

Why, after all these years, are we still doing this stupid thing of using a global namespace for packages? If you are a company with an internal package registry just publish all your packages as @companyname/mylib and then no one can squat the name on a public registry. I thought we collectively learned this 4 years ago when dependency confusion attacks were first disclosed.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#20

Post by woodruffw »

tru3_power wrote: post #16
woodruffw wrote: post #2

Without more context, this doesn't look great for Snyk either way: either they have an employee using NPM to live test their own services, or they have insufficient controls/processes for performing a legitimate audit of Cursor without using public resources.

Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo

> They might have just been showing that this is possible during an assessment. No harm no foul here imo

You're not supposed to leave public artifacts or test on public services during an assessment.

It's possible Cursor asked them to do so, but there's no public indication of this either. That's why I qualified my original comment. However, even if they did ask them to, it's typically not appropriate to use a separate unrelated public service (NPM) to perform the demo.

Source: I've done a handful of security assessments of public packaging indices.

Post reply on HN