Snyk security researcher deploys malicious NPM packages targeting cursor.com • Hacker News Board

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#91

Post by cedws » Tue, Jan 14, 2025, 5:34 AM UTC

3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

I started doing development under a separate non-admin user on my MacBook. I switch to another user for personal stuff, or the admin user to install stuff with Homebrew. Doesn't protect from zero days but it's better than nothing.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#92

Post by edm0nd » Tue, Jan 14, 2025, 5:34 AM UTC

supriyo-biswas wrote: post #50

Is there a link for the "githax" tool shown in the blog post, which seems to be quite useful? There's [1] but it's just a banner image. [1] https://www.githax.com/

The dev is https://github.com/6mile (same as author of the article)

seems to be either a tool that isnt out yet or perhaps not available for free or the public.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#93

Post by alpb » Tue, Jan 14, 2025, 5:39 AM UTC

KennyBlanken wrote: post #31

rettichschnidi wrote: post #17

OT: Has anyone ever gotten (proper) SBOMs for Snyks own tools and services? Asking because they want to sell my employee their solution (which does SBOMs).

Snyk is founded by people from the Israeli Army's Unit 8200. I wouldn't install it if you paid me to, because it feels a lot like Unit 8200 pumps out entrepreneurs and funds them so that (like the NSA) they have their foot already in the door.

Wiz.io (who almost sold to Google for $25bn) also had founders from IDF Unit 8200. Dozens of other companies like Waze, Palo Alto Networks were also the same.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#94

Post by brookst » Tue, Jan 14, 2025, 5:42 AM UTC

Atotalnoob wrote: post #63

IAmGraydon wrote: post #60

Earlier quoted context omitted.

[flagged]

It’s a techbro thing. Sama does it too

e. e. cummings, techbro. who knew?

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#95

Post by furyofantares » Tue, Jan 14, 2025, 5:42 AM UTC

IAmGraydon wrote: post #60

ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

When I grew up online in the 90s, on IRC, AOL/AIM, ICQ and web forums, it was extremely common. Most of the people I know from then still do it, and I still do it with them and in many other places, although for whatever reason I don't do it here. Although it's 50/50 when on their phones now that phones auto-capitalize by default now.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#96

Post by pmontra » Tue, Jan 14, 2025, 5:43 AM UTC

redserk wrote: post #43

3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

A customer of mine still uses vagrant on a project, for local development. That project started in 2016. We are developing on a mix of Linux, Mac, Windows and it's not as straightforward as it could be. Linux is easier, Windows is messier.

A newer project fires up VMs from a Python script that calls an adapter for EC2 (with the boto library) when run on AWs and for VirtualBox (by calling VBoxManage) when running locally. That allows us to simulate EC2 locally: it's a project that has to deal with many long jobs so we start VMs for them and terminate the VMs when the jobs are done. That also runs better on our mix of development systems. WSL2 helped to ease the pains of developing on Windows. We call the native Windows VirtualBox, not the one we could have installed inside WSL2, but we keep most of the code that runs on Linux.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#97

Post by johnny22 » Tue, Jan 14, 2025, 5:51 AM UTC

IAmGraydon wrote: post #60

ArVID220u wrote: post #25

Earlier quoted context omitted.

cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…

[flagged]

it's been a thing at least on irc for at least 20 years. i've been used to it for a long time.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#98

Post by petesergeant » Tue, Jan 14, 2025, 6:10 AM UTC

3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

I wonder how long until this is standard, and PFYs coming into the industry look at our current practices much like people now look at non-encrypted credentials being sent over the network.

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#99

Post by mmsc » Tue, Jan 14, 2025, 6:13 AM UTC

woodruffw wrote: post #89

compootr wrote: post #79

Earlier quoted context omitted.

if Cursor is secure it shouldn't be a problem for them! (and, according to their comments, it is)

It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.

How should it have been done differently? How else is the researcher supposed to know if the attack works? "Hey random company, we have no proof it's going to work but we think maybe your system, which we can't see, is vulnerable! Go waste time and check!"

Re: Snyk security researcher deploys malicious NPM packages targeting cursor.com

#100

Post by arcanemachiner » Tue, Jan 14, 2025, 6:19 AM UTC

redserk wrote: post #43

3eb7988a1663 wrote: post #21

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

Vagrant’s popularity seems to have died down with Docker containers but it’s by far my favorite way to make dev environments. Several years ago I worked somewhere that prohibited web browsers and development tools on laptops. If you needed to use a browser, you’d have to use one over Citrix. If you needed to code, you’d use a VDI or run the tools in a VM. At the time I thought their approach was clinically insane, bu…

I still like Vagrant. But I believe it's yet another victim of the Hashicorp license change debacle from a year or two ago.

Unlike with Terraform/OpenBao, I know of no community effort effort to keep the open-source version of this project alive. The latest open source version is still available on the Ubuntu repo, but who knows who long it will work until somefor of bit rot occurs.