Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

61–70 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#61

Post by buildbot »

redserk wrote: post #43
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

Vagrant is still kicking! But yeah not as popular as back in 2014-2016?

A hybrid(?) alternative is enroot, which is pretty neat IMO, it converts a docker container into a squashfs file that can be mounted rw or used in an ephemeral way. https://github.com/NVIDIA/enroot

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#62

Post by lolinder »

bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

Just a reminder that Unit 8200 is staffed mostly by conscripts who are serving out their mandatory military service and chose to accept an invitation to serve in the cyberwarfare arm of the IDF instead of choosing to shoot guns.

In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#63

Post by Atotalnoob »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

It’s a techbro thing.

Sama does it too

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#64

Post by defrost »

PoppinFreshDo wrote: post #59
bbqfog wrote: post #53

Earlier quoted context omitted.

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

What pager incident?

The recent one in which Israeli techs compromised pager supply chains.

It was very widely reported across the globe.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#65

Post by 0xbadcafebee »

lopkeny12ko wrote: post #18

Why, after all these years, are we still doing this stupid thing of using a global namespace for packages? If you are a company with an internal package registry just publish all your packages as @companyname/mylib and then no one can squat the name on a public registry. I thought we collectively learned this 4 years ago when dependency confusion attacks were first disclosed.

The usual reasons: laziness, ignorance, poor design. Most package managers suck at letting you add 3rd party repos. Most package managers don't have namespaces of any kind. The ones that do have terrible design. Most of them lack a verification system or curation. Most of them have terrible search. None of them seem to have been exposed to hierarchical naming or package inheritance. And a very small number of people understand security in general, many fewer are educated about all the attack classes.

But all of that is why they get popular. Lazy, crappy, easy things are more popular than intentional, complex, harder things. Shitty popular tech wins.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#66

Post by mhitza »

PoppinFreshDo wrote: post #59
bbqfog wrote: post #53

Earlier quoted context omitted.

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

What pager incident?

https://en.m.wikipedia.org/wiki/2024_Lebanon_electronic_devi...

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#67

Post by chrismarlow9 »

technion wrote: post #34
3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

I think a lot of the issues in this particular example is the ease with which api keys, once leaked, are single factor passwords. If you ran a key logger on my machine you would never get into any major site with mfa. You couldn't watch me log on to the azure console with passkey and do much with it. But if you scrape a saved key with publish abilities bad things happen.

What's to stop me from installing custom certs and MITM your login session proxying the info. Or an extension to harvest the data after you login. I'm pretty sure if I have root it's game over one way or another. The surface is massive.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#68

Post by danenania »

lolinder wrote: post #29
PessimalDecimal wrote: post #26

Earlier quoted context omitted.

https://www.timesofisrael.com/hezbollah-pager-explosions-put... Just months ago, some of those "kids who are very good with computers" caused compromised pagers to explode, with no knowledge of who would be near them. Civilians, including children, died as a result. It is right to think people who are "good with computers" in this way might not have the best intentions in their other applications of computers.

The other alternative that those kids were given was to shoot guns or missiles. Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people? Any Israeli citizen in that age bracket today is going to be running a real risk of killing people. They don't have a choice (dodging the draft doesn't count as a choice). If you're going…

Why doesn’t refusing the draft count as a choice?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#69

Post by [deleted] »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

[deleted]

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#70

Post by kstrauser »

bbqfog wrote: post #53
kstrauser wrote: post #5

Earlier quoted context omitted.

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

And what does that have to do with Snyk, other than that some of their employees use to work for IDF?

I'm a US Navy veteran. Would you also stay away from my employers because they have veterans on staff?

Seriously, I get what you're trying to say, but I don't understand the broader point you're trying to make. So Snyk has some ex-IDF employees. Find a high-profile infosec firm that doesn't. They military service they were compelled to has a reputation at being really, really good at infosec. I see no reason why companies shouldn't want to hire them afterward.

Post reply on HN