Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

241–250 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#241

Post by guappa »

Alifatisk wrote: post #234
guappa wrote: post #139

Earlier quoted context omitted.

I just stick to using whatever is on my distribution for personal use. For work use I use a work machine and if it gets compromised it's not really my own problem.

> For work I use a work machine and if it gets compromised it's not really my own problem. Is that really a good mindset for a organization?

I guess so… there seems to be absolutely no consequences to getting hacked, so from a business perspective it makes a lot of sense.

It's not up to me to decide what policy to use, and if it was I couldn't just do whatever I wanted, I'd have to justify its cost. And every company does the same…

I can decide the policy at my home :)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#242

Post by lmm »

weatherlite wrote: post #221
lmm wrote: post #113

Earlier quoted context omitted.

> In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no? You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you w…

> Just as you have to treat all Chinese companies as under control of the PRC government and all Australian companies as compromised by their security services, you have to treat all Israeli citizens as under the control of the Israeli military Got it , and are now all American companies suspect because they are managed behind the scenes by Musk and Trump?

All American companies are suspect given the National Security Letter system yes. (Also South Korea and Kazakhstan, and obviously also any country where the "rule of law" is low enough that governments can do as they wish without formal legal powers)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#243

Post by lmm »

lolinder wrote: post #220
lmm wrote: post #113

Earlier quoted context omitted.

> In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no? You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you w…

> You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you would do in his position. No, that doesn't mean you should trust him. No, you can't, because the scammer in the call center is choosing that over thousands of other options. Are they choosing to m…

> the scammer in the call center is choosing that over thousands of other options.

No, they're the people who don't have other options (because they lack the skills and/or qualifications and/or are discriminated against). It's not malice, it's just desperation to get money to live on (or, often, to provide for people who depend on them). But of course the end result is the same.

> The rest of your comment is totally irrational fear-based speculation.

Entirely rational given the historical pattern of behaviour shown by the Israeli military, and the fact that they have no reason to change (quite the opposite).

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#244

Post by pjmlp »

uticus wrote: post #227
pjmlp wrote: post #167

Earlier quoted context omitted.

The security, and overall application stability attack vector, is why I now vouch for processes with OS IPC instead of shared libraries, even if it requires more resources. It doesn't fully sort out the trust issue though, even if everything is sandboxed in some fashion.

I know of IPC, but it has never occurred to me to view as an alternative to shared libraries. It's an intriguing viewpoint I'm having trouble wrapping my mind around. Are there battle-tested real-life examples of IPC being used where shared libs could have been used instead?

VSCode would be one such example.

All the stuff using Android intents, out-proc COM extensions in Windows, XPS in macOS, are other relevant set of examples.

I assume you are kind of new to the computing world, OS IPC is how we extended applications almost 40 years before shared libraries became common feature across all major operating systems.

Naturally with them being around, shared memory in-process was much easier, and less resource intensive. IPC calls require processes, which take more kernel resources, and context switch.

Microservices isn't a new concept, rather re-branding.

Sun had as marketing quote, "The network is the computer", exactly because of how it used to be.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#245

Post by arccy »

bbqfog wrote: post #230
lolinder wrote: post #62

Earlier quoted context omitted.

Just a reminder that Unit 8200 is staffed mostly by conscripts who are serving out their mandatory military service and chose to accept an invitation to serve in the cyberwarfare arm of the IDF instead of choosing to shoot guns. In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later,…

I would under no circumstance join the IDF or even live in Israel. They’re not “kids”, they are military personnel.

key word: "conscript"

if you're born there, you have little choice in the matter.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#246

Post by fkyoureadthedoc »

objectified wrote: post #206
miki123211 wrote: post #187

Earlier quoted context omitted.

You can also console.log those credentials as a PoC, and then show that the console.log could trivially be replaced by a fetch(). Kind of like a lot of exploit PoCs just "pop a calc" (AKA open the Calculator app), not because opening the calculator is valuable to an attacker, but because if you can open calculator, you can do anything.

The problem there though, is that with PoCs like this, as an attacker you want to have a ping back to your system so that you know the attack has been successful (in this case they probably expected/hoped someone at Cursor to install the package, that's the usual objective in a dependency confusion attack). But what they could have done, is send a less sensitive thing like just the current working directory or curren…

What actually changes though in your scenario? Potential bad actor gets RCE on your dev machines, it doesn't really matter what they sent home, you're rotating keys and doing your due diligence either way.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#247

Post by matwood »

ceejayoz wrote: post #191
gyoridavid wrote: post #138

Earlier quoted context omitted.

"insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D

I get surprisingly many cold emails these days with a passive aggressive “shall we schedule a call, or are you a bad person who doesn’t give a shit about security?” approach.

Yeah. Or 'make this change to help our processes'. Um, that's not my job.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#248

Post by bbqfog »

arccy wrote: post #245
bbqfog wrote: post #230

Earlier quoted context omitted.

I would under no circumstance join the IDF or even live in Israel. They’re not “kids”, they are military personnel.

key word: "conscript" if you're born there, you have little choice in the matter.

I've never met an Israeli who wasn't a dual citizen. It's a choice to stay in Israel and fight in the IDF. In fact, the Snyk founder lives in London now: https://uk.linkedin.com/in/guypo

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#249

Post by krainboltgreene »

ziddoap wrote: post #237
gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

> If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? This would be where different security advice would apply: don't pull in a package that has 400 dependencies.

Given the nature of software development and software developers, especially given American companies decide to value shareholder profits over programmer productivity, this might as well be effectively "You don't need to get vaccines, simply don't get sick from other people."

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#250

Post by chamomeal »

gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

Wait how in the world does a React carousel component have over 400 deps…
Post reply on HN