Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

281–290 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#281

Post by bbqfog »

lolinder wrote: post #278
bbqfog wrote: post #248

Earlier quoted context omitted.

I've never met an Israeli who wasn't a dual citizen. It's a choice to stay in Israel and fight in the IDF. In fact, the Snyk founder lives in London now: https://uk.linkedin.com/in/guypo

> I've never met an Israeli who wasn't a dual citizen. Given that unless you are in Israel you're most likely to be meeting Israeli expats or at the very least people who travel, that's hardly surprising and not great evidence for anything. > In fact, the Snyk founder lives in London now So you're acknowledging that you're going to hold their country of origin against them even after they've moved. Got it.

I don’t understand your complaint. People are free to vocally denounce Zionism. These founders have not done that. Quite the opposite, Snyk has offices in Israel and has been vocal about their ties to the IDF. It’s absolutely within my agency to not use their products. Again, there’s zero downside to do that.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#282

Post by zero_shift »

tristor wrote: post #262
chamomeal wrote: post #250

Earlier quoted context omitted.

Wait how in the world does a React carousel component have over 400 deps…

Because Javascript is a drug that makes developers stupid. It's almost trite at this point to comment on the obsession that Node has created with developers to reduce functionality to the smallest possible reusable parts, even trivial things, and publish them as packages, then to import and use those dependencies. The idea, in and of itself, is not terrible, but it's been taken to a logical extreme which is very much…

Nearly all of these look like demo projects. You're making inferences about an entire group of developers based on a meme plus a search over the very 'worst' offenders.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#283

Post by robszumski »

absqueued wrote: post #173
hu3 wrote: post #126

A colleague of mine vendors npm dependencies to diff code between third party lib changes. Those are also covered in pull request reviews. Helps in cases like this.

Could you please explain a little more. I can use such practice in my dev workflow.

this is an area that is top of mind for me right now. you don't have to vendor your deps to get a detailed report of what changed, and bonus, how your app calls into it. just wrote about it: https://edgebit.io/blog/code-diff-reachability/

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#284

Post by jdthedisciple »

Seriously: How do we know there aren't dozens or hundreds of comprimsed npm packages installed on every other server out there at this point?

Think xz-utils but even much less sophisticated exploits.

I don't see any systematic protection against this?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#285

Post by lolinder »

bbqfog wrote: post #281
lolinder wrote: post #278

Earlier quoted context omitted.

> I've never met an Israeli who wasn't a dual citizen. Given that unless you are in Israel you're most likely to be meeting Israeli expats or at the very least people who travel, that's hardly surprising and not great evidence for anything. > In fact, the Snyk founder lives in London now So you're acknowledging that you're going to hold their country of origin against them even after they've moved. Got it.

I don’t understand your complaint. People are free to vocally denounce Zionism. These founders have not done that. Quite the opposite, Snyk has offices in Israel and has been vocal about their ties to the IDF. It’s absolutely within my agency to not use their products. Again, there’s zero downside to do that.

Correct, you're welcome to do that, and I'm welcome to denounce you for advocating boycotting a product because of the country of origin of its founders.

People can't help where they're born, and you're wrong to hold that against them. You're welcome to work through that cognitive dissonance however you like, but in the meantime I will continue to advocate for treating individuals as individuals.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#286

Post by bbqfog »

lolinder wrote: post #285
bbqfog wrote: post #281

Earlier quoted context omitted.

I don’t understand your complaint. People are free to vocally denounce Zionism. These founders have not done that. Quite the opposite, Snyk has offices in Israel and has been vocal about their ties to the IDF. It’s absolutely within my agency to not use their products. Again, there’s zero downside to do that.

Correct, you're welcome to do that, and I'm welcome to denounce you for advocating boycotting a product because of the country of origin of its founders. People can't help where they're born, and you're wrong to hold that against them. You're welcome to work through that cognitive dissonance however you like, but in the meantime I will continue to advocate for treating individuals as individuals.

No one is entitled to my business. I have no cognitive dissonance, my business interests are aligned with my moral interests in this case. I don’t use Israeli tech whenever possible.

You “denouncing” people who make a rational calculation isn’t really helping to market the firms you are supporting.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#287

Post by chamomeal »

zero_shift wrote: post #280
chamomeal wrote: post #250

Earlier quoted context omitted.

Wait how in the world does a React carousel component have over 400 deps…

Do you mean https://www.npmjs.com/package/carousel-react ? By the looks of it, this was published by someone 7 years ago as part of a personal project. Nothing uses it. Going through that list... they all look like personal projects, with no dependents, and a single release by a single person.

Ok now that I’ve actually looked at the package.json, it seems like this must be a joke or something. It’s got packages for CLI arg parsing, math expression evaluation, hashing, etc.

When I’m back on my computer I may look at the source and confirm my suspicion that none of those are required for the carousel functionality lol

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#288

Post by lolinder »

bbqfog wrote: post #286
lolinder wrote: post #285

Earlier quoted context omitted.

Correct, you're welcome to do that, and I'm welcome to denounce you for advocating boycotting a product because of the country of origin of its founders. People can't help where they're born, and you're wrong to hold that against them. You're welcome to work through that cognitive dissonance however you like, but in the meantime I will continue to advocate for treating individuals as individuals.

No one is entitled to my business. I have no cognitive dissonance, my business interests are aligned with my moral interests in this case. I don’t use Israeli tech whenever possible. You “denouncing” people who make a rational calculation isn’t really helping to market the firms you are supporting.

I'm not supporting firms, I'm supporting the right of individuals to be seen as individuals rather than as members of a group assigned to them at birth.

That said, this obviously isn't going anywhere, so have a nice day.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#289

Post by jsjohnst »

redserk wrote: post #43
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

> At the time I thought their approach was clinically insane

Let’s be clear, it’s still clinically insane, even if marginally rationalized.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#290

Post by Sohcahtoa82 »

davedx wrote: post #118
rettichschnidi wrote: post #17

OT: Has anyone ever gotten (proper) SBOMs for Snyks own tools and services? Asking because they want to sell my employee their solution (which does SBOMs).

Lots of false positives IME

That wasn't my experience when I used Snyk at my last job, depending on your definition of FP.

For example, if you're using a multi-protocol networking library, and it says that the version you have installed is has a vulnerability in its SMTP handling, but you don't use the SMTP functionality, is that a FP?

I'd argue that it's irrelevant, but not a false positive.

I never had it get the version of a library wrong.

Post reply on HN