Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

51–60 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#51

Post by tacticus »

redserk wrote: post #43
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

This is the practice in many government sites these days.

Except the vm is some old windows version without any tools on it. no shell access.

can't actually do anything useful on there at all.

VDI systems could work if implemented properly. but that's the last thing a security team actually wants to do.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#52

Post by benatkin »

syndicatedjelly wrote: post #32
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

Yeah, I strongly disagree with the way it's characterized here.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#53

Post by bbqfog »

kstrauser wrote: post #5
bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#54

Post by woodruffw »

KennyBlanken wrote: post #31
rettichschnidi wrote: post #17

OT: Has anyone ever gotten (proper) SBOMs for Snyks own tools and services? Asking because they want to sell my employee their solution (which does SBOMs).

Snyk is founded by people from the Israeli Army's Unit 8200. I wouldn't install it if you paid me to, because it feels a lot like Unit 8200 pumps out entrepreneurs and funds them so that (like the NSA) they have their foot already in the door.

Conspiracies and politics aside, the reasons for the prominence of 8200 are somewhat boring: it's the largest unit in the IDF, in a relatively small country. Teenagers who demonstrate just about any degree of technical savviness get funneled into it for their mandatory service.

It's the equivalent of observing that SFBA startups tend to have a lot of Stanford grads at the helm.

(I don't have any particular love for Snyk as a product suite. I think most supply chain security products are severely over-hyped.)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#55

Post by TimTheTinker »

benatkin wrote: post #52
syndicatedjelly wrote: post #32

Earlier quoted context omitted.

[flagged]

Yeah, I strongly disagree with the way it's characterized here.

> we reached out to them after seeing this and they apologized.

How does this make it sound like they made Snyk apologize?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#56

Post by lolinder »

PessimalDecimal wrote: post #39
lolinder wrote: post #29

Earlier quoted context omitted.

The other alternative that those kids were given was to shoot guns or missiles. Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people? Any Israeli citizen in that age bracket today is going to be running a real risk of killing people. They don't have a choice (dodging the draft doesn't count as a choice). If you're going…

> Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people? Yes. The "just following orders" excuse has been tried in the past. People didn't buy it then and we won't buy it now. https://www.nbcnews.com/news/world/israel-soldiers-arrest-ab... If the IDF wants to name the specific individuals from Unit 8200 who were involved…

(I deleted a comment that didn't seem relevant any more now that you added a bunch.)

So it's okay to blame vets of Unit 8200 for its actions 10 years after they founded Snyk (I have no idea how long after they left the unit) on the grounds that the intelligence arm of the IDF doesn't name names? So just in case and in the face of all the facts of the timelines, we should make sure to drag out these people's former mandatory service and remind everyone they served alongside bad guys 10+ years ago?

I'm not okay with blaming soldiers for following orders. When it's that or getting shot by your own side, there isn't a real choice. But I can't even begin to understand the mindset that would blame soldiers for the orders that other, unrelated soldiers followed more than 10 years later. That's some next-level hatred.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#57

Post by xyzzy123 »

kstrauser wrote: post #5
bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I'd give good odds it was a mistake by a staff member (or small group) who overstepped and was not part of any formal work.

Most companies where I've worked as a security researcher, you get some time as part of your job to hack on random stuff to be able to generate interesting talks / research. This feels like that.

This isn't a special cyber spooky practice, most pentesting companies do this to generate IP (rarely, lol), buzz (reasonably often) and keep the staff happy (this is really the main thing).

It's rare for management to be fully across the scope of this.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#59

Post by PoppinFreshDo »

bbqfog wrote: post #53
kstrauser wrote: post #5

Earlier quoted context omitted.

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

What pager incident?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#60

Post by IAmGraydon »

ArVID220u wrote: post #25
n2d4 wrote: post #15

[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them] Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0]. Assumably, this Snyk employee either found or suspected that some part of Cursor's build is misc…

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]
Post reply on HN