Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

141–150 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#141

Post by mardifoufs »

lolinder wrote: post #56
PessimalDecimal wrote: post #39

Earlier quoted context omitted.

> Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people? Yes. The "just following orders" excuse has been tried in the past. People didn't buy it then and we won't buy it now. https://www.nbcnews.com/news/world/israel-soldiers-arrest-ab... If the IDF wants to name the specific individuals from Unit 8200 who were involved…

(I deleted a comment that didn't seem relevant any more now that you added a bunch.) So it's okay to blame vets of Unit 8200 for its actions 10 years after they founded Snyk (I have no idea how long after they left the unit) on the grounds that the intelligence arm of the IDF doesn't name names? So just in case and in the face of all the facts of the timelines, we should make sure to drag out these people's former ma…

Yes, because it's an institutional problem. I'm sure you have no issues using products developed by say, ex FSB agents just because it's been 10 years?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#142

Post by guappa »

woodruffw wrote: post #20
tru3_power wrote: post #16

Earlier quoted context omitted.

Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo

> They might have just been showing that this is possible during an assessment. No harm no foul here imo You're not supposed to leave public artifacts or test on public services during an assessment. It's possible Cursor asked them to do so, but there's no public indication of this either. That's why I qualified my original comment. However, even if they did ask them to, it's typically not appropriate to use a separa…

Comments here seem to indicate that cursor did NOT ask them to (unless of course someone inside the company did and didn't tell the others)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#144

Post by 3eb7988a1663 »

pinoy420 wrote: post #85
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Why would you do anything but work related activities on a work machine. If you really want trust for software. Don’t use a computer.

I never said anything about personal stuff on a work machine? I want my own hardware to have isolation between my email/banking/etc and side project programming.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#146

Post by 6mile »

reubenmorais wrote: post #128
nomilk wrote: post #71

Earlier quoted context omitted.

> "pretty irresponsible" Wouldn't it be more like "pretty illegal"? They could have simply used body: JSON.stringify("worked"), i.e. not sent target machines’ actual environment variables, including keys.

It's an unfortunate incentive structure. If you're doing offensive security research, there's two ways you can go about it: you can report the potential vulnerability without exploiting it, in which case you risk the company coming back to you and saying "thanks but we don't consider this a vulnerability because it's only exploited through misconfiguration and we're too smart for that". Maybe you get some token rewar…

Yeah, I agree the incentive structure is broken for bug bounty hunters. Until the BB platforms themselves create some rules for their customers and researchers, we are gonna continue to have the sh*t show that we do now. The reality is that bug bounty hunters are deploying a significant percentage of the total malicious NPM packages each month.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#147

Post by guappa »

gyoridavid wrote: post #138
guappa wrote: post #134

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because appar…

"insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D

Sorry, I searched, it seems all my emails from before the last company rename are gone.

edit: or microsoft outlook sucks… I tried to sort in reverse my inbox to see what's the oldest email there and "the request cannot be satisfied"

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#148

Post by 3eb7988a1663 »

cedws wrote: post #91
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

I started doing development under a separate non-admin user on my MacBook. I switch to another user for personal stuff, or the admin user to install stuff with Homebrew. Doesn't protect from zero days but it's better than nothing.

I toyed around with this a bit, and it feels like it has significant merit. User separation is about the only security boundary built into Linux from the beginning. I was not totally happy with the workflow I adopted, but it is probably going to be less burdensome than the VM approach.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#149

Post by gunnarmorling »

In the Java world, you need to prove ownership of a given namespace (group id), e.g. via a TXT record for that domain. Isn't there a similar concept for NPM? The package is named sn4k-s3c/call-home, how will a victim be tricked into referencing that namespace sn4k-s3c (which I suppose is owned by the attacker, not Cursor)? I feel like I'm missing part of the picture here.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#150

Post by 6mile »

nomilk wrote: post #27

> All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. Wouldn't a lot of small packages consist of just these two files, meaning seeing just these two files in a package may raise an eyebrow but hardly be a smoking gun?

It's not a smoking gun. It is just one of a number of signals you look for when identifying potentially malicious packages. Other things you look for are number of collaborators, how long it existed, domains it talks to, and artifacts it pulls in.
Post reply on HN