Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

311–320 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#311

Post by compootr »

cheema33 wrote: post #174
mmsc wrote: post #99

Earlier quoted context omitted.

How should it have been done differently? How else is the researcher supposed to know if the attack works? "Hey random company, we have no proof it's going to work but we think maybe your system, which we can't see, is vulnerable! Go waste time and check!"

Cursor team has already stated here that they did not ask Snyk to perform a security audit. I wonder if Snyk's actions are equivalent to me coming to your house late at night and then trying to open any and all doors and windows. In the name of security research. Without an invitation from you. How else am I to validate that your house is secure?

I don't think it's like checking the locks in this case... more like adding a landmine in an apartment complex for cursor to trip on maybe ;)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#312

Post by guappa »

devjab wrote: post #160
hollowturtle wrote: post #46

Looks like NPM is generating jobs for those in the security field. It’s an unfixable mess, I really hope some competition like JSR will put enough pressure on the organization.

It's not just NPM, it's the trust in third party libraries in general. Even though it's much rarer, you'll see exploits on platforms like Nuget. You're also going to see them on JSR. You have more security because they are immutable, but you're not protected from downloading a malicious pacakge before it's outed. I think what we're more likely to see is that leglislation like DORA and NSIS increasinly require that yo…

I think NPM makes it worse because it's common to have hundreds, or thousands of dependencies. Which makes it easier to hide a malicious one in there.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#313

Post by [deleted] »

bbqfog wrote: post #297
krembo wrote: post #296

Earlier quoted context omitted.

Do you need some help with that? I'll be more than happy if antisemites like you won't be using any of the advanced tech we're working hard to create .

Sure, where do you work? I’ll be happy to add it to my list!

[deleted]

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#314

Post by guappa »

6mile wrote: post #150
nomilk wrote: post #27

> All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. Wouldn't a lot of small packages consist of just these two files, meaning seeing just these two files in a package may raise an eyebrow but hardly be a smoking gun?

It's not a smoking gun. It is just one of a number of signals you look for when identifying potentially malicious packages. Other things you look for are number of collaborators, how long it existed, domains it talks to, and artifacts it pulls in.

> are number of collaborators

You have any idea how easy it is to fake it?

Also, snyk doesn't scan code that isn't on github, because they are under the impression that all the code in the world is on github, so things like gnome.org, debian salsa or codeberg are completely ignored.

So you won't get reliable data from snyk.

edit: snyk doesn't scan code at all, they rely on unrelated "metrics" to give a rating that is not very useful.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#315

Post by guappa »

MortyWaves wrote: post #183
hu3 wrote: post #179

Earlier quoted context omitted.

Sure. They don't include "node_modules" directory in their .gitignore file. So any third party code changes end up in git commits and are easily visible and reviweable. So running npm update/upgrade includes the code that changed in the dependencies in the commit.

Surely there has to be better ways of “vendoring” (including hosting your own package repository that doesn’t automatically pull new versions) than adding thousands or maybe tens of thousands of files to the git repo?

On debian I do debdiff to see the differences between two source packages.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#316

Post by guappa »

rdegges wrote: post #293

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cur…

> The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables.

And exfiltration was needed to confirm a vulnerability why exactly?

I love how completely unaware you guys are.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#317

Post by guappa »

cko wrote: post #304
jdthedisciple wrote: post #284

Seriously: How do we know there aren't dozens or hundreds of comprimsed npm packages installed on every other server out there at this point? Think xz-utils but even much less sophisticated exploits. I don't see any systematic protection against this?

> I don't see any systematic protection against this? Snyk

Ah yes, add malware and sell malware detection. The perfect business idea.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#318

Post by guappa »

ignoramous wrote: post #186
woodruffw wrote: post #54

Earlier quoted context omitted.

Conspiracies and politics aside, the reasons for the prominence of 8200 are somewhat boring: it's the largest unit in the IDF, in a relatively small country. Teenagers who demonstrate just about any degree of technical savviness get funneled into it for their mandatory service. It's the equivalent of observing that SFBA startups tend to have a lot of Stanford grads at the helm. (I don't have any particular love for S…

> Conspiracies Not when the dissidents put their name to paper. We, veterans of Unit 8200, reserve soldiers both past and present, declare that we refuse to take part in actions against Palestinians and refuse to continue serving as tools in deepening the military control over the Occupied Territories. It is commonly thought that the service in military intelligence is free of moral dilemmas and solely contributes to…

It's signed by 34 people… I guess we can say it's completely irrelevant.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#319

Post by guappa »

__jonas wrote: post #225
that_guy_iain wrote: post #210

Earlier quoted context omitted.

The data they extract is nothing sensitive and this way they can see how many hits they get. The more affected the bigger the headline for them.

In what world is "all environment variables" nothing sensitive?

Even just the username is sensitive because it gives hint on what to try with ssh attempts.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#320

Post by guappa »

etyp wrote: post #236
dannyallan wrote: post #222

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk d…

Seems reasonable enough, but why would it (allegedly) send environment variables back via a POST? Even if it's entirely in good faith, I'd rather some random package not have my `env` output..

Not allegedly. They confirmed it themselves.

https://snyk.io/blog/snyk-security-labs-testing-update-curso...

Post reply on HN