Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

111–120 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#111

Post by pritambaral »

whitehexagon wrote: post #105
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

It's horrible that trust is being eroded so much, and seeing monthly GB updates to my OS doesnt reassure me at all. I like the idea of having a stable isolated VM for each project. Are there standard open-source tools to do this? Specifically I'm transitioning my Go and Zig development environments from an old mac to an M1 with Asahi Linux and getting a bit lost even finding replacements for Truecrypt and Little Snit…

I run all my dev environments under LXD. Even the IDE: full graphical Emacs (or Vim) over X11 forwarding over SSH. Host is Wayland, so security concerns with X are handled. WayPipe also works, but is jankier than X, probably because X, unlike Wayland, was designed for network transparency.

LXD, unlike Docker, doesn't play fast-and-loose with security. It runs rootless by default, and I don't allow non-root access to the LXD socket on host. Each container is a full userspace, so it's much more convenient to configure and use than Dockerfiles.

SSH from a container to a remote works transparently because I forward my SSH Agent. This is secure because my agent confirms each signing request with a GUI popup (on host).

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#112

Post by stouset »

pizza wrote: post #90
IAmGraydon wrote: post #60

Earlier quoted context omitted.

[flagged]

yes but there could be many possible reasons, for instance - it's muuch faster on mobile - you're aiming to convey litheness to potential target audiences who will know to recognize it as intentional litheness - you've gotten used to minimizing the amount of keystrokes necessary for communicating things, to the point it's second nature - you've worked a lot in the past with older nlp systems, where ignoring capitaliz…

> it's muuch faster on mobile

This isn’t 1998. Mobile keyboards autocapitalize. You have to go out of your way to avoid capitalization on mobile.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#113

Post by lmm »

lolinder wrote: post #62
bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

Just a reminder that Unit 8200 is staffed mostly by conscripts who are serving out their mandatory military service and chose to accept an invitation to serve in the cyberwarfare arm of the IDF instead of choosing to shoot guns. In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later,…

> In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no?

You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you would do in his position. No, that doesn't mean you should trust him.

Just as you have to treat all Chinese companies as under control of the PRC government and all Australian companies as compromised by their security services, you have to treat all Israeli citizens as under the control of the Israeli military. Any adult can be conscripted and they have a history of disguising military operations as civilian ones. Someone might tell you they left the Israeli military 10 years ago and they're probably telling the truth, but if you make a habit of believing that statement you're going to get burned.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#114

Post by demarq »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

how does this bother you, what greater meaning does it have?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#115

Post by mmsc »

bostik wrote: post #103
mmsc wrote: post #99

Earlier quoted context omitted.

How should it have been done differently? How else is the researcher supposed to know if the attack works? "Hey random company, we have no proof it's going to work but we think maybe your system, which we can't see, is vulnerable! Go waste time and check!"

Local DNS override, and two registries. One mirroring the relevant public NPM packages as they are, and one "normal" internal one. Make the mirror registry resolvable with the same name(s) as the real, public NPM registry. Then test the behaviour.

I think there's an incorrect assumption that the Snyk team has any access to Cursor's systems, or their source code.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#116

Post by z3t4 »

XorNot wrote: post #77
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

The real problem is video performance in VMs. It still just...kind of sucks. Running Cinnamon in a VM is just about impossible to get GL acceleration working properly. nvidia gates it's virtualized GPU offerings behind their enterprise cards, so we're left with ineffective command translation. IMO: I can tolerate just about every other type of VM overhead, but choppy/unresponsive GUIs have a surprisingly bad ergonomi…

You can get good security without virtualization, for example SeLinux and namespaces in Linux. Jails in BSD and zones in Solaris. We would have many viable and competing solutions if it wasn't for Microsoft monopoly.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#117

Post by manquer »

woodruffw wrote: post #54
KennyBlanken wrote: post #31

Earlier quoted context omitted.

Snyk is founded by people from the Israeli Army's Unit 8200. I wouldn't install it if you paid me to, because it feels a lot like Unit 8200 pumps out entrepreneurs and funds them so that (like the NSA) they have their foot already in the door.

Conspiracies and politics aside, the reasons for the prominence of 8200 are somewhat boring: it's the largest unit in the IDF, in a relatively small country. Teenagers who demonstrate just about any degree of technical savviness get funneled into it for their mandatory service. It's the equivalent of observing that SFBA startups tend to have a lot of Stanford grads at the helm. (I don't have any particular love for S…

Talent or skills is essential but alone is not enough. while the size and quality of the talent pool helps it is not sufficient to explain the success rate, considering that there are similar or better quality talent pools which are larger in many countries around the world, but they don't have the success rates Israeli startups and 8200 ones specifically have compared to their home market and talent pool size.

It is not some conspiracy either, success as founder has strong network effects and positive feedback loops, right mentorship, access to talent pool, or access to funding and people who can open doors all becomes easier when your network already has some success. Similar reason second time founders have it easier they can tap into their personal version of a network.

It is not unusual to Israel/8200, the valley itself benefits from this effect heavily after all.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#119

Post by fancyswimtime »

arcanemachiner wrote: post #100
redserk wrote: post #43

Earlier quoted context omitted.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

I still like Vagrant. But I believe it's yet another victim of the Hashicorp license change debacle from a year or two ago. Unlike with Terraform/OpenBao, I know of no community effort effort to keep the open-source version of this project alive. The latest open source version is still available on the Ubuntu repo, but who knows who long it will work until somefor of bit rot occurs.

more so a victim of speed

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#120

Post by manquer »

kstrauser wrote: post #5
bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I would say it is on similar to criticism of TikTok or Huwaei and China.

It has less to do with whether it malicious intent from the start of building an organization for explicit intent of capturing core infra. It has more to do with how the Government of Israel operates and the legal requests they can make of their citizens and/or veterans.

Perhaps concern over Israeli products should be probably higher than for China as Israel more well known incidents of exploits as a State actor like with Stuxnet, Pegasus or more recently with pagers etc.

China no doubt has their own share of operations but they either have not used them as publicly in a large scale overt operation or been more discreet about it.

Point is the concern is valid just as it would be valid for China.

Post reply on HN