Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snyk security researcher deploys malicious NPM packages targeting cursor.com

sourcecodered.com

Post reply on HN
Print view View original

81–90 of 331 posts

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#81

Post by dekelpilli »

bbqfog wrote: post #53
kstrauser wrote: post #5

Earlier quoted context omitted.

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a r…

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

Based on the pager incident, I'd think you should avoid companies that don't have a publicly-known link to Israel. It's not like Hezbollah thought they were buying pagers from 8200 alumni.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#82

Post by BeefWellington »

tru3_power wrote: post #16
woodruffw wrote: post #2

Without more context, this doesn't look great for Snyk either way: either they have an employee using NPM to live test their own services, or they have insufficient controls/processes for performing a legitimate audit of Cursor without using public resources.

Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo

"No Harm No Foul" in this case would be a simple demonstrative failure case, not functioning malware.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#83

Post by [deleted] »

nomilk wrote: post #71
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

> "pretty irresponsible" Wouldn't it be more like "pretty illegal"? They could have simply used body: JSON.stringify("worked"), i.e. not sent target machines’ actual environment variables, including keys.

[deleted]

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#84

Post by Sophira »

dalton_zk wrote: post #36

Literally a test in production. The dev commit their work go to home thinking "not will happen"

If it was really a test, then why would it be sending environment variables via HTTP POST? There are many better ways to do this if you're legitimately deploying code remotely.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#85

Post by pinoy420 »

3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Why would you do anything but work related activities on a work machine. If you really want trust for software. Don’t use a computer.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#86

Post by yard2010 »

bbqfog wrote: post #3

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk

Don't hate the player hate the game ;)

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#87

Post by mmaunder »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

It’s a low effort flex. As in: you’re unimportant, this is unimportant, and I’m very busy, so I can’t or won’t bother to capitalize. Which is ironic because it’s more effort to not capitalize.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#88

Post by not_a_bot_4sho »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

It was a thing back in the late 90s. I still do it in casual conversations with friends, less so in professional settings.

It's a gen X thing, like using "lol" to mean literal laughter

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#89

Post by woodruffw »

compootr wrote: post #79
woodruffw wrote: post #20

Earlier quoted context omitted.

> They might have just been showing that this is possible during an assessment. No harm no foul here imo You're not supposed to leave public artifacts or test on public services during an assessment. It's possible Cursor asked them to do so, but there's no public indication of this either. That's why I qualified my original comment. However, even if they did ask them to, it's typically not appropriate to use a separa…

if Cursor is secure it shouldn't be a problem for them! (and, according to their comments, it is)

It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#90

Post by pizza »

IAmGraydon wrote: post #60
ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

yes but there could be many possible reasons, for instance

- it's muuch faster on mobile

- you're aiming to convey litheness to potential target audiences who will know to recognize it as intentional litheness

- you've gotten used to minimizing the amount of keystrokes necessary for communicating things, to the point it's second nature

- you've worked a lot in the past with older nlp systems, where ignoring capitalization was a given for inputs anyhow, and just got used to treating it as syntactic cruft only strictly necessary in more formal settings ;)

Post reply on HN