Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

171–180 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#171

Post by alias_neo »

XorNot wrote: post #77
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

The real problem is video performance in VMs. It still just...kind of sucks. Running Cinnamon in a VM is just about impossible to get GL acceleration working properly. nvidia gates it's virtualized GPU offerings behind their enterprise cards, so we're left with ineffective command translation. IMO: I can tolerate just about every other type of VM overhead, but choppy/unresponsive GUIs have a surprisingly bad ergonomi…

There are ways around it. There is a community of people who use Nvidia enterprise cards with vGPU for gaming, performance is excellent, or PCI pass through an entire GPU.

If you can't do that because it's for company/corporate purposes then I can sympathise with not wanting to pay Nvidia's prices.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#172

Post by cheema33 »

3eb7988a1663 wrote: post #153
pritambaral wrote: post #111

Earlier quoted context omitted.

I run all my dev environments under LXD. Even the IDE: full graphical Emacs (or Vim) over X11 forwarding over SSH. Host is Wayland, so security concerns with X are handled. WayPipe also works, but is jankier than X, probably because X, unlike Wayland, was designed for network transparency. LXD, unlike Docker, doesn't play fast-and-loose with security. It runs rootless by default, and I don't allow non-root access to…

Can you point to a write-up somewhere that details this setup? Part of the appeals of VMs is that they were built with security as a primary objective. I probably have to do something stupid to break that isolation. A custom ad hoc configuration makes me a bit nervous that I will unknowingly punch a Docker sized hole through my firewall and have less security than if I ran a stock workflow.

For me, I don't use LXD, but use Proxmox containers. These are non-root Linux containers by default. Super lightweight compared to a VM. Proxmox makes managing LXC containers a little easier with a UI, compared to managing containers strictly using command line.

If you go this route, create a container template that has everything you want in every instance. And then spin out new containers whenever you need one.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#173

Post by absqueued »

hu3 wrote: post #126

A colleague of mine vendors npm dependencies to diff code between third party lib changes. Those are also covered in pull request reviews. Helps in cases like this.

Could you please explain a little more. I can use such practice in my dev workflow.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#174

Post by cheema33 »

mmsc wrote: post #99
woodruffw wrote: post #89

Earlier quoted context omitted.

It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.

How should it have been done differently? How else is the researcher supposed to know if the attack works? "Hey random company, we have no proof it's going to work but we think maybe your system, which we can't see, is vulnerable! Go waste time and check!"

Cursor team has already stated here that they did not ask Snyk to perform a security audit. I wonder if Snyk's actions are equivalent to me coming to your house late at night and then trying to open any and all doors and windows. In the name of security research. Without an invitation from you.

How else am I to validate that your house is secure?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#175

Post by pinoy420 »

3eb7988a1663 wrote: post #144
pinoy420 wrote: post #85

Earlier quoted context omitted.

Why would you do anything but work related activities on a work machine. If you really want trust for software. Don’t use a computer.

I never said anything about personal stuff on a work machine? I want my own hardware to have isolation between my email/banking/etc and side project programming.

Then have a separate machine if you’re that paranoid. Funny how it doesn’t cause issue for the hundreds of thousands of other people in the world

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#176

Post by cheema33 »

skirge wrote: post #166

"no one can hack us" and then "you can't hack us, how dare you" game, 25 years and more

> "no one can hack us"

Did Cursor made claims to this effect and invited public to hack them?

Or are you equating someone saying they "take security seriously" to "it's an open season, please attack our systems."?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#178

Post by hennell »

gunnarmorling wrote: post #149

In the Java world, you need to prove ownership of a given namespace (group id), e.g. via a TXT record for that domain. Isn't there a similar concept for NPM? The package is named sn4k-s3c/call-home, how will a victim be tricked into referencing that namespace sn4k-s3c (which I suppose is owned by the attacker, not Cursor)? I feel like I'm missing part of the picture here.

You're not really missing anything so much as adding a misguided assumption of competence to NPM.

Npm doesn't really do namespaces. There's just no ownership to prove as most packages are published like "call-home" with no namespace required. This gives exciting opportunities for you to register cal-home to trap users who miss type, or caII-home to innocuously add to your own or open source projects or whatever. Fun isn't it?

In this case the call home package is namespaced, but the real attack is the packages like "cursor-always-local" which has no namespace. Which can sometimes (?) take precedence over a private package with the same name.

It's not a pretty picture, you were better off missing it really.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#179

Post by hu3 »

absqueued wrote: post #173
hu3 wrote: post #126

A colleague of mine vendors npm dependencies to diff code between third party lib changes. Those are also covered in pull request reviews. Helps in cases like this.

Could you please explain a little more. I can use such practice in my dev workflow.

Sure. They don't include "node_modules" directory in their .gitignore file.

So any third party code changes end up in git commits and are easily visible and reviweable.

So running npm update/upgrade includes the code that changed in the dependencies in the commit.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#180

Post by Cthulhu_ »

nikcub wrote: post #4

Looks like a white hat audit from Snyk testing. Got flagged because oastify.com is a default Burp Collaborator server. They should be running a private npm repo for tests (not difficult to override locally) and also their own collaborator server.

It's not white hat because they actively extract data; if it was just to prove it worked they could've done a console.log, cause npm install to fail, or not extract a payload.
Post reply on HN