Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

251–260 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#251

Post by kstrauser »

manquer wrote: post #120
kstrauser wrote: post #5

Earlier quoted context omitted.

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I would say it is on similar to criticism of TikTok or Huwaei and China. It has less to do with whether it malicious intent from the start of building an organization for explicit intent of capturing core infra. It has more to do with how the Government of Israel operates and the legal requests they can make of their citizens and/or veterans. Perhaps concern over Israeli products should be probably higher than for Ch…

You mean like how we found out that China attacked and pwn3d the entire US phone system? That’s not a shining example of discretion.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#252

Post by kittikitti »

NPM packages are the most bloated and unreadable pieces of code I've encountered. The creator of Node apparently hates all software and yet Google gave him the captain's hat and we're left with the absolute crap shoot that is web development. I feel guilty with an additional 1KB of code or 500 bytes of RAM but this is seen as an outsider opinion. I hope big tech rots and this is just a symptom. https://news.ycombinator.com/item?id=3055154

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#253

Post by XorNot »

gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

This is really where SELinux had the right idea overall: preclassifying files with data about their sensitivity, and denying access based on that, does adequately solve this problem (i.e. keeping npm installations away from id_rsa).

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#254

Post by zelphirkalt »

kittikitti wrote: post #252

NPM packages are the most bloated and unreadable pieces of code I've encountered. The creator of Node apparently hates all software and yet Google gave him the captain's hat and we're left with the absolute crap shoot that is web development. I feel guilty with an additional 1KB of code or 500 bytes of RAM but this is seen as an outsider opinion. I hope big tech rots and this is just a symptom. https://news.ycombinat…

NPM packages VS Wordpress plugins ... I think it is a head to head race there.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#255

Post by KuhlMensch »

chamomeal wrote: post #250
gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

Wait how in the world does a React carousel component have over 400 deps…

/giphy "first time?" meme

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#256

Post by whimsicalism »

reubenmorais wrote: post #128
nomilk wrote: post #71

Earlier quoted context omitted.

> "pretty irresponsible" Wouldn't it be more like "pretty illegal"? They could have simply used body: JSON.stringify("worked"), i.e. not sent target machines’ actual environment variables, including keys.

It's an unfortunate incentive structure. If you're doing offensive security research, there's two ways you can go about it: you can report the potential vulnerability without exploiting it, in which case you risk the company coming back to you and saying "thanks but we don't consider this a vulnerability because it's only exploited through misconfiguration and we're too smart for that". Maybe you get some token rewar…

a prerequisite of “offensive security research” is that it is solicited, no ifs or buts.

what they did was absolutely wrong and frankly likely illegal

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#257

Post by beardedwizard »

XorNot wrote: post #253
gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

This is really where SELinux had the right idea overall: preclassifying files with data about their sensitivity, and denying access based on that, does adequately solve this problem (i.e. keeping npm installations away from id_rsa).

The issue with SElinux is usability. A company called intrinsic tried a similar "allowlist" approach to javascript based on the assumption that you could never control this sprawl and had to assume every package was malicious. I never saw the technology take off because generating the allowlist was of course error prone.

im not sure what has to change in UX to make these approaches more palatable, but if you have to frequently allow 'good' behaviors, my experience is it never takes off.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#258

Post by pizzalife »

dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

What is responsible about sending the environment over in a proof of concept?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#259

Post by azemetre »

guappa wrote: post #134

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because appar…

They also penalize libraries that are "done," and require minimal development.

Completely backwards software that corpos only seem to buy because their insurers force them to check off some security list box.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#260

Post by Sohcahtoa82 »

chamomeal wrote: post #250
gortok wrote: post #235

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for to…

Wait how in the world does a React carousel component have over 400 deps…

Did you think the meme about node_modules having more gravity than a star was just a meme?

It's very much based on reality. The npm ecosystem is just absolutely fucked.

Post reply on HN