Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

301–310 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#301

Earlier quoted context omitted.

Fear of Israelis, sure. But hatred? Come on. Israel has done a lot in the past year, and is being accused of genocide. The fact that is used a conscript army makes it worse , not better. Also, okay then let's switch it up to the Russian army. Would you use a product with known ties to some electronic warfare russian army unit. Or rather, would you consider any doubts or hesitations over using said product to be "russ…

> The fact that is used a conscript army makes it worse, not better. I'm not defending the state, I'm defending the individuals who were conscripted. The entire point of this subthread is that it's heinous to confuse the two. > Would you use a product with known ties to some electronic warfare russian army unit. Or rather, would you consider any doubts or hesitations over using said product to be "russophobic"? If I…

To be honest, I don't disagree but I see why people do care about it.

In the sense that this is just a direct result of Israel's actions. They staged an incredibly powerful intelligence coup with the blown up pagers. Now I agree that if you aren't involved in middle Eastern politics, there's no reason to be scared of Israeli products (even if made by ex-israeli soldiers). But I completely understand where the reputational damage comes from, it was such a well executed operation that it does cast more doubts on anything related to Israel.

My point about conscription was that it is worse in the sense that most Israeli citizens can be de-facto coerced into becoming an agent of the state, making Israeli products inherently more suspicious (and more tied to state policy, regardless of the individuals involved). As you say, most Israelis don't necessarily chose to be in the army. A lot of Hamas fighters are also basically conscripts, but that nuance wouldn't matter for most either.

There's also just the purely ideological angle, which is also what happened to anything touching Russia back in 2022. That's the angle that I agree is mostly unjustifiable.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#302
post #299

Earlier quoted context omitted.

I think we need to to focus on empirical consensus rather than taking as authoritative some file which makes claims about what a particular piece of software will or won't do. So before running any code you'd hash it and ask your peers: "what do we think this does?" If it does something surprising, you roll back its effects (or maybe it was in a sandbox in the first place) and you update your peers so that next time…

This both is and isn't what SELinux does though: the point of SELinux is when you execute a binary, it runs with whatever context is assigned to it and is bounded by that context (or allowed transitions). This is super powerful to implement exactly that, but for whatever reason IMO it's constantly been half-assed on the UI front, because the best version of it isn't "detailed policy confinements for system software"…

As far as I'm aware it's missing the consensus part. If I run a program that's not supposed to touch the filesystem in any way, and it does, SELinux doesn't suggest a way for me to circulate this new knowledge among other users of this program--except through its maintainer or that of my Linux distro. And maintainer diligence is over-relied-on as it is.

Ideally this sort of thing would work just as well on bits for which there was no clear maintainer. Like if SETI turned up a signal which we can chmod +x and run, we could use it to crowd source an understanding of what it does.

A way to hash a file and ask:

> What is known about these bits?

If it's a popular program and yet none of your peers have seen that hash, maybe you should subject it to more scrutiny than if there's widespread consensus about it (it may have been tampered with).

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#303

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cur…

Sorry, but you screwed up royally. Scary to see that Snyk still does not see this.

Ethically, your work was even lower than that of those who test their AI tools on FOSS code, send in bogus reports and thus waste maintainer's time. Experimenting on unwitting humans and ecosystems is not okay.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#304

Seriously: How do we know there aren't dozens or hundreds of comprimsed npm packages installed on every other server out there at this point? Think xz-utils but even much less sophisticated exploits. I don't see any systematic protection against this?

> I don't see any systematic protection against this?

Snyk

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#305

In the Java world, you need to prove ownership of a given namespace (group id), e.g. via a TXT record for that domain. Isn't there a similar concept for NPM? The package is named sn4k-s3c/call-home, how will a victim be tricked into referencing that namespace sn4k-s3c (which I suppose is owned by the attacker, not Cursor)? I feel like I'm missing part of the picture here.

You're referring to what I described previously here... ironically back when the first dependency confusion research was published: https://www.sonatype.com/blog/why-namespacing-matters-in-pub...

Thanks, Brian! Big kudos to you and Sonatype for the service you provide to the Java community.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#307

Earlier quoted context omitted.

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-curso...

This response doesn't make a lot of sense. What's the justification for taking all of the environment variables? This post tries to paper over that particular problem. If your goal was to see if you could attack the dependency chain the first steps of user+hostname would have been sufficient to prove your case. Taking the environment variables is about taking the secrets, and kind of moves this from PoC to opposition…

Frankly I wouldn't be surprised if this was a case of Hanlon's razor. Some "researcher" thought well ENV vars will certainly show us what we want and that's where the conversation ended without thinking a little harder into what else might be in the vars.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#308
post #134

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because appar…

That's extremely unfortunate, especially about the "abandoned" labelling. I've been looking to move off GitHub recently as well, it feels like it's got a bit too much control. Codeberg looks interesting, and there are self-hosted ones like Forejo that also look great if you're okay with the maintenance.

I use codeberg :)

It has CI, pull requests, issues and whatnot. It also doesn't force you to use 2fa if you don't want :D

If you do corporate open source though, you're stuck on github because snyk, openssf, pypi and whatnot only interface with github.

For actual libre software codeberg is very good.

Keep in mind that debian salsa is open to everyone as well. The only annoyance is that non debian developers have a "-guest" suffix. But it's ok to use for projects that aren't debian specific.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#309
post #114

Earlier quoted context omitted.

[flagged]

how does this bother you, what greater meaning does it have?

I tend to shy away from intentional illiteracy and laziness, both of which this is an example of. Not capitalizing does also affect readability. That said, I was honestly asking because I’ve seen it a few times on HN in the last couple of weeks and was curious if it’s coincidence or an actual trend.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#310
post #207

Earlier quoted context omitted.

I'm sure you can provide the body of the [appropriately redacted] said email?

I was also sure until I found out that outlook refuses to search old emails.

There's an additional hoop to jump through for Outlook to actually search your whole inbox. Here are the steps (https://answers.microsoft.com/en-us/outlook_com/forum/all/ou...)
Post reply on HN