Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

231–240 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#231

Post by bbqfog »

weatherlite wrote: post #221
lmm wrote: post #113

Earlier quoted context omitted.

> In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no? You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you w…

> Just as you have to treat all Chinese companies as under control of the PRC government and all Australian companies as compromised by their security services, you have to treat all Israeli citizens as under the control of the Israeli military Got it , and are now all American companies suspect because they are managed behind the scenes by Musk and Trump?

I feel the same way about companies with CIA founders.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#232

Post by senorrib »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

Cool. Why phone home the user's environment, then? The vulnerability could very much be confirmed by simply sending a stub instead of live envs.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#233

Post by mardifoufs »

lolinder wrote: post #213
mardifoufs wrote: post #141

Earlier quoted context omitted.

Yes, because it's an institutional problem. I'm sure you have no issues using products developed by say, ex FSB agents just because it's been 10 years?

The FSB is no comparison because it's more equivalent to the NSA—it was a career path, not a place to serve out mandatory military service. FSB agents worked there for decades and chose that instead of any number of other things they could have done. Unit 8200 conscripts worked there for at most 2 years 8 months and chose it instead of a different, more gun-blazing branch of the military. Mandatory military service c…

Fear of Israelis, sure. But hatred? Come on. Israel has done a lot in the past year, and is being accused of genocide. The fact that is used a conscript army makes it worse, not better.

Also, okay then let's switch it up to the Russian army. Would you use a product with known ties to some electronic warfare russian army unit. Or rather, would you consider any doubts or hesitations over using said product to be "russophobic"?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#234

Post by Alifatisk »

guappa wrote: post #139
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

I just stick to using whatever is on my distribution for personal use. For work use I use a work machine and if it gets compromised it's not really my own problem.

> For work I use a work machine and if it gets compromised it's not really my own problem.

Is that really a good mindset for a organization?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#235

Post by gortok »

The only part of the article I disagree with is this line:

> But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not.

This works -- maybe OK for top-level packages. But for transitive dependencies it's nearly impossible to vet every transitive dependency.

If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? https://gist.github.com/anvaka/8e8fa57c7ee1350e3491#top-1000...

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#236

Post by etyp »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

Seems reasonable enough, but why would it (allegedly) send environment variables back via a POST? Even if it's entirely in good faith, I'd rather some random package not have my `env` output..

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#237

Post by ziddoap »

gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

>If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area?

This would be where different security advice would apply: don't pull in a package that has 400 dependencies.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#238

Post by yabones »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

This is grey-hat at best. Intent may have been good, but the fact is that this team created and distributed software to access and exfiltrate data without permission which is very illegal. You may want to consult with the legal department before posting about this on a public forum fyi.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#239

Post by [deleted] »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

[deleted]

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#240

Post by luma »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

Spraying your attack into the public with hopes of hitting your target is the polar opposite of responsible. The only "good" part of this is that you were caught in the act before anyone else got hit in the crossfire.

In response, you suggest that you'll send a letter of apology to the funeral home of anyone that got hit. Compromising their credentials, even if you have "good intentions", still puts them into a compromised position and they have to react the same as they would for any other malevolent attacker.

This is so close to "malicious" that it's hard to perceive a difference.

edit: Let's also remind everyone that a Snyk stakeholder is currently attempting to launch a Cursor competitor, so assuming good intentions is even MORE of a stretch.

Post reply on HN