13 ms·

Snyk security researcher deploys malicious NPM packages targeting cursor.com

574 points by arkadiyt 2y ago

rettichschnidi 2y ago
OT: Has anyone ever gotten (proper) SBOMs for Snyks own tools and services? Asking because they want to sell my employee their solution (which does SBOMs).
- KennyBlanken 2y ago
  Snyk is founded by people from the Israeli Army's Unit 8200. I wouldn't install it if you paid me to, because it feels a lot like Unit 8200 pumps out entrepreneurs and funds them so that (like the NSA) they have their foot already in the door.
  - woodruffw 2y ago
    Conspiracies and politics aside, the reasons for the prominence of 8200 are somewhat boring: it's the largest unit in the IDF, in a relatively small country. Teenagers who demonstrate just about any degree of technical savviness get funneled into it for their mandatory service. It's the equivalent of observing that SFBA startups tend to have a lot of Stanford grads at the helm. (I don't have any particular love for Snyk as a product suite. I think most supply chain security products are severely over-hyped.)
    - manquer 2y ago
      Talent or skills is essential but alone is not enough. while the size and quality of the talent pool helps it is not sufficient to explain the success rate, considering that there are similar or better quality talent pools which are larger in many countries around the world, but they don't have the success rates Israeli startups and 8200 ones specifically have compared to their home market and talent pool size. It is not some conspiracy either, success as founder has strong network effects and positive feedback loops, right mentorship, access to talent pool, or access to funding and people who can open doors all becomes easier when your network already has some success. Similar reason second time founders have it easier they can tap into their personal version of a network. It is not unusual to Israel/8200, the valley itself benefits from this effect heavily after all.
      - ignoramous 2y ago
        > benefits from this effect "Benefits" from whose perspective? For instance, the Brazilians (the State apparatus, specifically) are also benefiting [0], but are their citizens [1]? [0] https://www.jstor.org/stable/48595312 https://www.jstor.org/stable/48595312 [1] https://idanlandau-com.translate.goog/2016/02/04/technologies-of-oppression-between-israel-and-brazil/?_x_tr_sl=iw&_x_tr_tl=en https://idanlandau-com.translate.goog/2016/02/04/technologie...
        manquer 2y ago
        benefits from the perspective of the startup, i.e. chances of its success or growth. Who in turn benefits from that in terms wealth, power, influence is whole different topic for which i have no expertise, i was only talking about frequency of successes in startup clusters.
      - woodruffw 2y ago
        Right, it's not about talent. It's the fact that it's an extremely strong network with a flywheel between defense spending and startup tech. The same things that make the US's startup industry indefatigable.
    - ignoramous 2y ago
      > Conspiracies Not when the dissidents put their name to paper. We, veterans of Unit 8200, reserve soldiers both past and present, declare that we refuse to take part in actions against Palestinians and refuse to continue serving as tools in deepening the military control over the Occupied Territories. It is commonly thought that the service in military intelligence is free of moral dilemmas and solely contributes to the reduction of violence and harm to innocent people. However, our military service has taught us that intelligence is an integral part of Israel's military occupation over the territories. The Palestinian population under military rule is completely exposed to espionage and surveillance by Israeli intelligence. While there are severe limitations on the surveillance of Israeli citizens, the Palestinians are not afforded this protection. There's no distinction between Palestinians who are, and are not, involved in violence. Information that is collected and stored harms innocent people. It is used for political persecution and to create divisions within Palestinian society by recruiting collaborators and driving parts of Palestinian society against itself. In many cases, intelligence prevents defendants from receiving a fair trial in military courts, as the evidence against them is not revealed. Intelligence allows for the continued control over millions of people through thorough and intrusive supervision and invasion of most areas of life. This does not allow for people to lead normal lives, and fuels more violence further distancing us from the end of the conflict. https://www.theguardian.com/world/2014/sep/12/israeli-intelligence-veterans-letter-netanyahu-military-chiefs https://www.theguardian.com/world/2014/sep/12/israeli-intell... (and that's from 2014)
      - woodruffw 2y ago
        I don’t think this conflicts with what I’ve said. I’m not claiming Unit 8200 is moral or absolved; I’m saying only that you will run into a lot of 8200 veterans if you interact with any Israeli startup, since it’s a massive unit. Assuming that those people don’t have opinions of their own is likely incorrect, as this letter demonstrates.
      - guappa 2y ago
        It's signed by 34 people… I guess we can say it's completely irrelevant.
  - alpb 2y ago
    Wiz.io (who almost sold to Google for $25bn) also had founders from IDF Unit 8200. Dozens of other companies like Waze, Palo Alto Networks were also the same.
    - deleted 2y ago
      [deleted]
  - sgammon 2y ago
    Incredibuild is on this list (at least with regard to current leadership)
- davedx 2y ago
  Lots of false positives IME
  - Sohcahtoa82 2y ago
    That wasn't my experience when I used Snyk at my last job, depending on your definition of FP. For example, if you're using a multi-protocol networking library, and it says that the version you have installed is has a vulnerability in its SMTP handling, but you don't use the SMTP functionality, is that a FP? I'd argue that it's irrelevant, but not a false positive. I never had it get the version of a library wrong.
- de130W 2y ago
  Got better results with Syft
xyst 2y ago
You either die as a white hat or live long enough to see yourself become a black hat.
woodruffw 2y ago
Without more context, this doesn't look great for Snyk either way: either they have an employee using NPM to live test their own services, or they have insufficient controls/processes for performing a legitimate audit of Cursor without using public resources.
- tru3_power 2y ago
  Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo
  - woodruffw 2y ago
    > They might have just been showing that this is possible during an assessment. No harm no foul here imo You're not supposed to leave public artifacts or test on public services during an assessment. It's possible Cursor asked them to do so, but there's no public indication of this either. That's why I qualified my original comment. However, even if they did ask them to, it's typically not appropriate to use a separate unrelated public service (NPM) to perform the demo. Source: I've done a handful of security assessments of public packaging indices.
    - compootr 2y ago
      if Cursor is secure it shouldn't be a problem for them! (and, according to their comments, it is)
      - woodruffw 2y ago
        It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.
        2y ago
bbqfog 2y ago
Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk https://en.wikipedia.org/wiki/Snyk
- kstrauser 2y ago
  I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a reminder that this armed bodyguard service comprises Navy SEALs and Army Rangers". Uh, great!
  - CuriouslyC 2y ago
    Maybe if you change that to "armed bodyguard services employ ex KGB assassins"
    - nullityrofl 2y ago
      I think you've missed the point: it's Americentric to assume that Navy SEALs and Army Rangers are inherently pure, good and have done nothing evil on behalf of the American government when we largely know that to be untrue.
      - kstrauser 2y ago
        That wasn't my point at all. The point was that often the best people to protect a resource are the ones who know how to attack it.
  - myth_drannon 2y ago
    [flagged]
nikcub 2y ago
Looks like a white hat audit from Snyk testing. Got flagged because oastify.com is a default Burp Collaborator server. They should be running a private npm repo for tests (not difficult to override locally) and also their own collaborator server.
- Cthulhu_ 2y ago
  It's not white hat because they actively extract data; if it was just to prove it worked they could've done a console.log, cause npm install to fail, or not extract a payload.
  - that_guy_iain 2y ago
    The data they extract is nothing sensitive and this way they can see how many hits they get. The more affected the bigger the headline for them.
    - __jonas 2y ago
      In what world is "all environment variables" nothing sensitive?
      - guappa 2y ago
        Even just the username is sensitive because it gives hint on what to try with ssh attempts.
nathabonfim59 2y ago
Things like this could _synk_ their reputation...
- guappa 2y ago
  They're terrible already. If you invest enough in marketing nothing matters.
n2d4 2y ago
[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them] Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0]. Assumably, this Snyk employee either found or suspected that some part of Cursor's build is misconfigured as above, and uploaded those packages as a POC. (Given the package description "for Cursor", I'd think they were hired for this purpose.) If that's the case, then there's not much to see here. The security researcher couldn't have used a private NPM registry to perform the POC if the point is to demonstrate a misconfiguration which skips the private registry. . [0] In particular, many proxies will choose the public over the private registry if the latest package version is higher: https://snyk.io/blog/detect-prevent-dependency-confusion-attacks-npm-supply-chain-security/ https://snyk.io/blog/detect-prevent-dependency-confusion-att...
- arkadiyt 2y ago
  > If that's the case, then there's not much to see here They could have demonstrated the POC without sending data about the installing host, including all your environment variables, upstream. That seems like crossing the line
- ArVID220u 2y ago
  cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions https://github.com/microsoft/vscode/tree/main/extensions) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they were trying to do here (but i think your explanation that someone there suspected a dependency confusion vulnerability is plausible. though it's pretty irresponsible imo to do that on public npm and actually sending up the env variables)
  - syndicatedjelly 2y ago
    [flagged]
lopkeny12ko 2y ago
Why, after all these years, are we still doing this stupid thing of using a global namespace for packages? If you are a company with an internal package registry just publish all your packages as @companyname/mylib and then no one can squat the name on a public registry. I thought we collectively learned this 4 years ago when dependency confusion attacks were first disclosed.
- 0xbadcafebee 2y ago
  The usual reasons: laziness, ignorance, poor design. Most package managers suck at letting you add 3rd party repos. Most package managers don't have namespaces of any kind. The ones that do have terrible design. Most of them lack a verification system or curation. Most of them have terrible search. None of them seem to have been exposed to hierarchical naming or package inheritance. And a very small number of people understand security in general, many fewer are educated about all the attack classes. But all of that is why they get popular. Lazy, crappy, easy things are more popular than intentional, complex, harder things. Shitty popular tech wins.
3eb7988a1663 2y ago
I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.
- petesergeant 2y ago
  I wonder how long until this is standard, and PFYs coming into the industry look at our current practices much like people now look at non-encrypted credentials being sent over the network.
- technion 2y ago
  I think a lot of the issues in this particular example is the ease with which api keys, once leaked, are single factor passwords. If you ran a key logger on my machine you would never get into any major site with mfa. You couldn't watch me log on to the azure console with passkey and do much with it. But if you scrape a saved key with publish abilities bad things happen.
  - chrismarlow9 2y ago
    What's to stop me from installing custom certs and MITM your login session proxying the info. Or an extension to harvest the data after you login. I'm pretty sure if I have root it's game over one way or another. The surface is massive.
    - technion 2y ago
      At that point you've done something much more invasive and detectable than exporting a .env file and you've walked away with a very short lived token. There's always "something more an attacker can do", I'll stand by the view that requiring further authentication to perform interactive actions and pushes is worthwhile.
- redserk 2y ago
nomilk 2y ago
> All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. Wouldn't a lot of small packages consist of just these two files, meaning seeing just these two files in a package may raise an eyebrow but hardly be a smoking gun?
- 6mile 2y ago
  It's not a smoking gun. It is just one of a number of signals you look for when identifying potentially malicious packages. Other things you look for are number of collaborators, how long it existed, domains it talks to, and artifacts it pulls in.
  - guappa 2y ago
    > are number of collaborators You have any idea how easy it is to fake it? Also, snyk doesn't scan code that isn't on github, because they are under the impression that all the code in the world is on github, so things like gnome.org, debian salsa or codeberg are completely ignored. So you won't get reliable data from snyk. edit: snyk doesn't scan code at all, they rely on unrelated "metrics" to give a rating that is not very useful.
dalton_zk 2y ago
Literally a test in production. The dev commit their work go to home thinking "not will happen"
- Sophira 2y ago
  If it was really a test, then why would it be sending environment variables via HTTP POST? There are many better ways to do this if you're legitimately deploying code remotely.
hollowturtle 2y ago
Looks like NPM is generating jobs for those in the security field. It’s an unfixable mess, I really hope some competition like JSR will put enough pressure on the organization.
- devjab 2y ago
  It's not just NPM, it's the trust in third party libraries in general. Even though it's much rarer, you'll see exploits on platforms like Nuget. You're also going to see them on JSR. You have more security because they are immutable, but you're not protected from downloading a malicious pacakge before it's outed. I think what we're more likely to see is that leglislation like DORA and NSIS increasinly require that you audit third party packages. This enforcing a different way of doing development in critical industries. I also think you're going to see a lot less usage of external packages in the age of LLM's. Because why would you pull an external package to generate something like your OpenAPI specification when any LLM can write a cli script that does it for you in an hour or two of configuring it to your needs? Similarily, you don't need to use LLM's directly to auto-generate "boring" parts of your code, you can have them build cli tools which does it. That way you're not relying on outside factors, and while I can almost guarantee that these cli tools will be horrible cowboy code, their output will be what you refine the tools to make. With languages like Go pushing everything you need in their standard packages, you're looking at a world where you can do a lot of things with nothing but the standard library very easily.
  - guappa 2y ago
    I think NPM makes it worse because it's common to have hundreds, or thousands of dependencies. Which makes it easier to hide a malicious one in there.
jijji 2y ago
npm is rife with this activity, its like wordpress plugins
- mrweasel 2y ago
  As much as I don't like NPM, these issues aren't limited to NPM. It's just that NPM is getting so much attention that we're more likely to find and hear about these issues when when they target NPM. I'm fairly concerned about the state of Python packages. It's not every week, but I frequently stumble upon packages that are not what they appear to be. Sometimes not maliciously, sometimes the author just got overly ambitious and failed to deliver, other times, someone is clearly typo-squatting or attempting to get you to install the wrong thing.
supriyo-biswas 2y ago
Is there a link for the "githax" tool shown in the blog post, which seems to be quite useful? There's [1] but it's just a banner image. [1] https://www.githax.com/ https://www.githax.com/
- edm0nd 2y ago
  The dev is https://github.com/6mile https://github.com/6mile (same as author of the article) seems to be either a tool that isnt out yet or perhaps not available for free or the public.
  - 6mile 2y ago
    GitHax is a labour of love right now and is in heavy development. I'm going to create a small beta testing group soon. Hit me up if you want to be in that group. Contact deets are in my GH profile.
PoppinFreshDo 2y ago
I'm sure it's all part of some tiktok prank video.
sneak 2y ago
Side note: Snyk (founded 2015, computer and network security) has nothing to do with @sneak (hacking since 1998, computer and network security). I was dismayed to learn about their choice of brand, and think it might cause confusion. :(
- vips7L 2y ago
  I don’t even read those the same. To me snyk is read as snick and not sneak.
- rdegges 2y ago
  The name 'snyk' is an acronym, it stands for 'so now you know' (about security vulnerabilities) =D
raybb 2y ago
[flagged]
hu3 2y ago
A colleague of mine vendors npm dependencies to diff code between third party lib changes. Those are also covered in pull request reviews. Helps in cases like this.
- absqueued 2y ago
  Could you please explain a little more. I can use such practice in my dev workflow.
  - hu3 2y ago
    Sure. They don't include "node_modules" directory in their .gitignore file. So any third party code changes end up in git commits and are easily visible and reviweable. So running npm update/upgrade includes the code that changed in the dependencies in the commit.
    - MortyWaves 2y ago
      Surely there has to be better ways of “vendoring” (including hosting your own package repository that doesn’t automatically pull new versions) than adding thousands or maybe tens of thousands of files to the git repo?
      - compootr 2y ago
        if it's dumb and it works it isn't dumb! another rather simple solution is a git mirror of each package, then point npm to a git url
      - xdennis 2y ago
        If my podcast memory serves, that's how Isaac (the NPM guy) said it was intended. You would `npm install` and then `git commit`. That's why npm didn't have a lock file back then. Git was the lock file.
      - guappa 2y ago
        On debian I do debdiff to see the differences between two source packages.
tankster 2y ago
Also interestingly the Snyk cofounder has started a competitor to cursor https://www.tessl.io/ https://www.tessl.io/ https://techcrunch.com/2024/11/14/tessl-raises-125m-at-at-500m-valuation-to-build-ai-that-writes-and-maintains-code/ https://techcrunch.com/2024/11/14/tessl-raises-125m-at-at-50... I hope there is no foul play.
- guappa 2y ago
  Given how all my interactions with them have been extremely negative (see my other comment), I think it's rather likely that there is foul play.
deleted 2y ago
[deleted]
guappa 2y ago
snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because apparently not being interested in buying their product means you're an incompetent developer who can only write software filled with vulnerabilities.
- gyoridavid 2y ago
  "insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D
  - guappa 2y ago
    Sorry, I searched, it seems all my emails from before the last company rename are gone. edit: or microsoft outlook sucks… I tried to sort in reverse my inbox to see what's the oldest email there and "the request cannot be satisfied"
    - unixhero 2y ago
      Ouch, I kind of trusted it. ... more than Gmail and Google
  - ceejayoz 2y ago
    I get surprisingly many cold emails these days with a passive aggressive “shall we schedule a call, or are you a bad person who doesn’t give a shit about security?” approach.
    - matwood 2y ago
      Yeah. Or 'make this change to help our processes'. Um, that's not my job.
- 2y ago
bugtodiffer 2y ago
We have read this exact story before, please learn not to leak too much sensitive data with your PoCs
gunnarmorling 2y ago
In the Java world, you need to prove ownership of a given namespace (group id), e.g. via a TXT record for that domain. Isn't there a similar concept for NPM? The package is named sn4k-s3c/call-home, how will a victim be tricked into referencing that namespace sn4k-s3c (which I suppose is owned by the attacker, not Cursor)? I feel like I'm missing part of the picture here.
- hennell 2y ago
  You're not really missing anything so much as adding a misguided assumption of competence to NPM. Npm doesn't really do namespaces. There's just no ownership to prove as most packages are published like "call-home" with no namespace required. This gives exciting opportunities for you to register cal-home to trap users who miss type, or caII-home to innocuously add to your own or open source projects or whatever. Fun isn't it? In this case the call home package is namespaced, but the real attack is the packages like "cursor-always-local" which has no namespace. Which can sometimes (?) take precedence over a private package with the same name. It's not a pretty picture, you were better off missing it really.
  - Vaguely2178 2y ago
    > Npm doesn't really do namespaces. Yes it really does. npm has namespaces (called scoped packages) and even explicitly encourages their use for private packages to avoid this sort of attack. From the npm docs: "A variant of this attack is when a public package is registered with the same name of a private package that an organization is using. We strongly encourage using scoped packages to ensure that a private package isn’t being substituted with one from the public registry." [1] > This gives exciting opportunities for you to register cal-home to trap users who miss type, or caII-home to innocuously add to your own or open source projects or whatever. Fun isn't it? npm actively blocks typo-squatting attacks during the publishing process: "Attackers may attempt to trick others into installing a malicious package by registering a package with a similar name to a popular package, in hopes that people will mistype or otherwise confuse the two. npm is able to detect typosquat attacks and block the publishing of these packages." [1] This thread is full of people demonstrating the concept of confirmation bias. [1] https://docs.npmjs.com/threats-and-mitigations https://docs.npmjs.com/threats-and-mitigations
stuaxo 2y ago
"It's a good idea not to use npm packages blindly" Yes, but also impractical.
justmarc 2y ago
[flagged]
- cheema33 2y ago
  > Yawn. Wrong forum perhaps? Or wrong story? But you clicked the story. Read it. And then even bothered to comment on it. You are putting a lot of effort into something that does not interest you.
skirge 2y ago
"no one can hack us" and then "you can't hack us, how dare you" game, 25 years and more
- cheema33 2y ago
  > "no one can hack us" Did Cursor made claims to this effect and invited public to hack them? Or are you equating someone saying they "take security seriously" to "it's an open season, please attack our systems."?
  - skirge 2y ago
    yes it is, like independent product reviews or crash tests of cars. Anyway Kim Jong Un doesn't care.
deleted 2y ago
[deleted]
SebFender 2y ago
Behind hundreds of builds Snyk has been a challenging integration that ultimately creates very low value. I recommend using a decent team that goes in for flow weaknesses as these are most responsible for significant findings...
fintechie 2y ago
Hopefully this makes the Cursor team reconsider security (which doesn't seem very good really). Stopped using it for serious stuff after I noticed their LLMs grabs your whole .env files and sends them to their server... even after you add them to their .cursorignore file. Bizarre stuff. Now imagine a bad actor exploiting this... recipe for disaster.
- miohtama 2y ago
  Security often means the opposite of scalability and growth, so why should they? The business goal is to make sure Cursor grows large enough that they have economics of scale to be a viable business. If you want secure LLM you can use Mistral, which comes with all the EU limitations, good and bad.
  - yunwal 2y ago
    Mistral (an LLM company) is not really a substitute for cursor (an IDE). Tabby is probably the closest open-source alternative. https://github.com/TabbyML/tabby https://github.com/TabbyML/tabby
jtdev 2y ago
[dead]
deleted 2y ago
[deleted]
dannyallan 2y ago
Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk does follow a responsible disclosure policy and while no one picked this package up, had anyone done so, we would have immediately followed up with them.
- senorrib 2y ago
  Cool. Why phone home the user's environment, then? The vulnerability could very much be confirmed by simply sending a stub instead of live envs.
- etyp 2y ago
  Seems reasonable enough, but why would it (allegedly) send environment variables back via a POST? Even if it's entirely in good faith, I'd rather some random package not have my `env` output..
  - guappa 2y ago
    Not allegedly. They confirmed it themselves. https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/ https://snyk.io/blog/snyk-security-labs-testing-update-curso...
- yabones 2y ago
  This is grey-hat at best. Intent may have been good, but the fact is that this team created and distributed software to access and exfiltrate data without permission which is very illegal. You may want to consult with the legal department before posting about this on a public forum fyi.
- deleted 2y ago
  [deleted]
- luma 2y ago
gortok 2y ago
The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for top-level packages. But for transitive dependencies it's nearly impossible to vet every transitive dependency. If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? https://gist.github.com/anvaka/8e8fa57c7ee1350e3491#top-1000-packages-with-most-dependencies https://gist.github.com/anvaka/8e8fa57c7ee1350e3491#top-1000...
- ziddoap 2y ago
  >If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? This would be where different security advice would apply: don't pull in a package that has 400 dependencies.
  - krainboltgreene 2y ago
    Given the nature of software development and software developers, especially given American companies decide to value shareholder profits over programmer productivity, this might as well be effectively "You don't need to get vaccines, simply don't get sick from other people."
    - nightpool 2y ago
      Out of curiosity, I've always meant to ask, are you related to the famous Geoguesser content creator in any way? It's a pretty distinctive last name.
      - krainboltgreene 2y ago
        I believe he might be a distant cousin. I've done some family tree searching myself and haven't found many things, since the Rainbolt side has mostly been scoundrels and vagabonds there aren't many details, but we do have a mountain that we named after ourselves after we stole it from natives.
kittikitti 2y ago
NPM packages are the most bloated and unreadable pieces of code I've encountered. The creator of Node apparently hates all software and yet Google gave him the captain's hat and we're left with the absolute crap shoot that is web development. I feel guilty with an additional 1KB of code or 500 bytes of RAM but this is seen as an outsider opinion. I hope big tech rots and this is just a symptom. https://news.ycombinator.com/item?id=3055154 https://news.ycombinator.com/item?id=3055154
- zelphirkalt 2y ago
  NPM packages VS Wordpress plugins ... I think it is a head to head race there.
jdthedisciple 2y ago
Seriously: How do we know there aren't dozens or hundreds of comprimsed npm packages installed on every other server out there at this point? Think xz-utils but even much less sophisticated exploits. I don't see any systematic protection against this?
- cko 2y ago
  > I don't see any systematic protection against this? Snyk
  - guappa 2y ago
    Ah yes, add malware and sell malware detection. The perfect business idea.
rdegges 2y ago
Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/ https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cursor, but found no vulnerabilities. There's no malicious intent or action here, but I can certainly understand how it appears when there's not a ton of information and things like this occur! As a sidenote, I use Cursor all the time and love it <3
- rettichschnidi 2y ago
  Sorry, but you screwed up royally. Scary to see that Snyk still does not see this. Ethically, your work was even lower than that of those who test their AI tools on FOSS code, send in bogus reports and thus waste maintainer's time. Experimenting on unwitting humans and ecosystems is not okay.
- guappa 2y ago
  > The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables. And exfiltration was needed to confirm a vulnerability why exactly? I love how completely unaware you guys are.

574 points by arkadiyt 2y ago

OT: Has anyone ever gotten (proper) SBOMs for Snyks own tools and services? Asking because they want to sell my employee their solution (which does SBOMs).

KennyBlanken 2y ago
Snyk is founded by people from the Israeli Army's Unit 8200. I wouldn't install it if you paid me to, because it feels a lot like Unit 8200 pumps out entrepreneurs and funds them so that (like the NSA) they have their foot already in the door.
- woodruffw 2y ago
  Conspiracies and politics aside, the reasons for the prominence of 8200 are somewhat boring: it's the largest unit in the IDF, in a relatively small country. Teenagers who demonstrate just about any degree of technical savviness get funneled into it for their mandatory service. It's the equivalent of observing that SFBA startups tend to have a lot of Stanford grads at the helm. (I don't have any particular love for Snyk as a product suite. I think most supply chain security products are severely over-hyped.)
  - manquer 2y ago
    Talent or skills is essential but alone is not enough. while the size and quality of the talent pool helps it is not sufficient to explain the success rate, considering that there are similar or better quality talent pools which are larger in many countries around the world, but they don't have the success rates Israeli startups and 8200 ones specifically have compared to their home market and talent pool size. It is not some conspiracy either, success as founder has strong network effects and positive feedback loops, right mentorship, access to talent pool, or access to funding and people who can open doors all becomes easier when your network already has some success. Similar reason second time founders have it easier they can tap into their personal version of a network. It is not unusual to Israel/8200, the valley itself benefits from this effect heavily after all.
    - ignoramous 2y ago
      > benefits from this effect "Benefits" from whose perspective? For instance, the Brazilians (the State apparatus, specifically) are also benefiting [0], but are their citizens [1]? [0] https://www.jstor.org/stable/48595312 https://www.jstor.org/stable/48595312 [1] https://idanlandau-com.translate.goog/2016/02/04/technologies-of-oppression-between-israel-and-brazil/?_x_tr_sl=iw&_x_tr_tl=en https://idanlandau-com.translate.goog/2016/02/04/technologie...
      - manquer 2y ago
        benefits from the perspective of the startup, i.e. chances of its success or growth. Who in turn benefits from that in terms wealth, power, influence is whole different topic for which i have no expertise, i was only talking about frequency of successes in startup clusters.
    - woodruffw 2y ago
      Right, it's not about talent. It's the fact that it's an extremely strong network with a flywheel between defense spending and startup tech. The same things that make the US's startup industry indefatigable.
  - ignoramous 2y ago
    > Conspiracies Not when the dissidents put their name to paper. We, veterans of Unit 8200, reserve soldiers both past and present, declare that we refuse to take part in actions against Palestinians and refuse to continue serving as tools in deepening the military control over the Occupied Territories. It is commonly thought that the service in military intelligence is free of moral dilemmas and solely contributes to the reduction of violence and harm to innocent people. However, our military service has taught us that intelligence is an integral part of Israel's military occupation over the territories. The Palestinian population under military rule is completely exposed to espionage and surveillance by Israeli intelligence. While there are severe limitations on the surveillance of Israeli citizens, the Palestinians are not afforded this protection. There's no distinction between Palestinians who are, and are not, involved in violence. Information that is collected and stored harms innocent people. It is used for political persecution and to create divisions within Palestinian society by recruiting collaborators and driving parts of Palestinian society against itself. In many cases, intelligence prevents defendants from receiving a fair trial in military courts, as the evidence against them is not revealed. Intelligence allows for the continued control over millions of people through thorough and intrusive supervision and invasion of most areas of life. This does not allow for people to lead normal lives, and fuels more violence further distancing us from the end of the conflict. https://www.theguardian.com/world/2014/sep/12/israeli-intelligence-veterans-letter-netanyahu-military-chiefs https://www.theguardian.com/world/2014/sep/12/israeli-intell... (and that's from 2014)
    - woodruffw 2y ago
      I don’t think this conflicts with what I’ve said. I’m not claiming Unit 8200 is moral or absolved; I’m saying only that you will run into a lot of 8200 veterans if you interact with any Israeli startup, since it’s a massive unit. Assuming that those people don’t have opinions of their own is likely incorrect, as this letter demonstrates.
    - guappa 2y ago
      It's signed by 34 people… I guess we can say it's completely irrelevant.
- alpb 2y ago
  Wiz.io (who almost sold to Google for $25bn) also had founders from IDF Unit 8200. Dozens of other companies like Waze, Palo Alto Networks were also the same.
  - deleted 2y ago
    [deleted]
- sgammon 2y ago
  Incredibuild is on this list (at least with regard to current leadership)
davedx 2y ago
Lots of false positives IME
- Sohcahtoa82 2y ago
  That wasn't my experience when I used Snyk at my last job, depending on your definition of FP. For example, if you're using a multi-protocol networking library, and it says that the version you have installed is has a vulnerability in its SMTP handling, but you don't use the SMTP functionality, is that a FP? I'd argue that it's irrelevant, but not a false positive. I never had it get the version of a library wrong.
de130W 2y ago
Got better results with Syft

xyst 2y ago

You either die as a white hat or live long enough to see yourself become a black hat.

woodruffw 2y ago

Without more context, this doesn't look great for Snyk either way: either they have an employee using NPM to live test their own services, or they have insufficient controls/processes for performing a legitimate audit of Cursor without using public resources.

tru3_power 2y ago
Why not? NPM behaves oddly when there is a public package named the same as one on a private repo, in some cases it’ll fetch the public one instead. I believe it’s called package squatting or something. They might have just been showing that this is possible during an assessment. No harm no foul here imo
- woodruffw 2y ago
  > They might have just been showing that this is possible during an assessment. No harm no foul here imo You're not supposed to leave public artifacts or test on public services during an assessment. It's possible Cursor asked them to do so, but there's no public indication of this either. That's why I qualified my original comment. However, even if they did ask them to, it's typically not appropriate to use a separate unrelated public service (NPM) to perform the demo. Source: I've done a handful of security assessments of public packaging indices.
  - compootr 2y ago
    if Cursor is secure it shouldn't be a problem for them! (and, according to their comments, it is)
    - woodruffw 2y ago
      It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.
      - 2y ago

bbqfog 2y ago

Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains. https://en.wikipedia.org/wiki/Snyk https://en.wikipedia.org/wiki/Snyk

kstrauser 2y ago
I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks. Your criticism sounds to me like "just a reminder that this armed bodyguard service comprises Navy SEALs and Army Rangers". Uh, great!
- CuriouslyC 2y ago
  Maybe if you change that to "armed bodyguard services employ ex KGB assassins"
  - nullityrofl 2y ago
    I think you've missed the point: it's Americentric to assume that Navy SEALs and Army Rangers are inherently pure, good and have done nothing evil on behalf of the American government when we largely know that to be untrue.
    - kstrauser 2y ago
      That wasn't my point at all. The point was that often the best people to protect a resource are the ones who know how to attack it.
- myth_drannon 2y ago
  [flagged]

nikcub 2y ago

Looks like a white hat audit from Snyk testing. Got flagged because oastify.com is a default Burp Collaborator server. They should be running a private npm repo for tests (not difficult to override locally) and also their own collaborator server.

Cthulhu_ 2y ago
It's not white hat because they actively extract data; if it was just to prove it worked they could've done a console.log, cause npm install to fail, or not extract a payload.
- that_guy_iain 2y ago
  The data they extract is nothing sensitive and this way they can see how many hits they get. The more affected the bigger the headline for them.
  - __jonas 2y ago
    In what world is "all environment variables" nothing sensitive?
    - guappa 2y ago
      Even just the username is sensitive because it gives hint on what to try with ssh attempts.

nathabonfim59 2y ago

Things like this could _synk_ their reputation...

guappa 2y ago
They're terrible already. If you invest enough in marketing nothing matters.

n2d4 2y ago

[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them] Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0]. Assumably, this Snyk employee either found or suspected that some part of Cursor's build is misconfigured as above, and uploaded those packages as a POC. (Given the package description "for Cursor", I'd think they were hired for this purpose.) If that's the case, then there's not much to see here. The security researcher couldn't have used a private NPM registry to perform the POC if the point is to demonstrate a misconfiguration which skips the private registry. . [0] In particular, many proxies will choose the public over the private registry if the latest package version is higher: https://snyk.io/blog/detect-prevent-dependency-confusion-attacks-npm-supply-chain-security/ https://snyk.io/blog/detect-prevent-dependency-confusion-att...

arkadiyt 2y ago
> If that's the case, then there's not much to see here They could have demonstrated the POC without sending data about the installing host, including all your environment variables, upstream. That seems like crossing the line
ArVID220u 2y ago
cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions https://github.com/microsoft/vscode/tree/main/extensions) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they were trying to do here (but i think your explanation that someone there suspected a dependency confusion vulnerability is plausible. though it's pretty irresponsible imo to do that on public npm and actually sending up the env variables)
- syndicatedjelly 2y ago
  [flagged]

lopkeny12ko 2y ago

Why, after all these years, are we still doing this stupid thing of using a global namespace for packages? If you are a company with an internal package registry just publish all your packages as @companyname/mylib and then no one can squat the name on a public registry. I thought we collectively learned this 4 years ago when dependency confusion attacks were first disclosed.

0xbadcafebee 2y ago
The usual reasons: laziness, ignorance, poor design. Most package managers suck at letting you add 3rd party repos. Most package managers don't have namespaces of any kind. The ones that do have terrible design. Most of them lack a verification system or curation. Most of them have terrible search. None of them seem to have been exposed to hierarchical naming or package inheritance. And a very small number of people understand security in general, many fewer are educated about all the attack classes. But all of that is why they get popular. Lazy, crappy, easy things are more popular than intentional, complex, harder things. Shitty popular tech wins.

3eb7988a1663 2y ago

I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.

petesergeant 2y ago
I wonder how long until this is standard, and PFYs coming into the industry look at our current practices much like people now look at non-encrypted credentials being sent over the network.
technion 2y ago
I think a lot of the issues in this particular example is the ease with which api keys, once leaked, are single factor passwords. If you ran a key logger on my machine you would never get into any major site with mfa. You couldn't watch me log on to the azure console with passkey and do much with it. But if you scrape a saved key with publish abilities bad things happen.
- chrismarlow9 2y ago
  What's to stop me from installing custom certs and MITM your login session proxying the info. Or an extension to harvest the data after you login. I'm pretty sure if I have root it's game over one way or another. The surface is massive.
  - technion 2y ago
    At that point you've done something much more invasive and detectable than exporting a .env file and you've walked away with a very short lived token. There's always "something more an attacker can do", I'll stand by the view that requiring further authentication to perform interactive actions and pushes is worthwhile.
redserk 2y ago

nomilk 2y ago

> All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. Wouldn't a lot of small packages consist of just these two files, meaning seeing just these two files in a package may raise an eyebrow but hardly be a smoking gun?

6mile 2y ago
It's not a smoking gun. It is just one of a number of signals you look for when identifying potentially malicious packages. Other things you look for are number of collaborators, how long it existed, domains it talks to, and artifacts it pulls in.
- guappa 2y ago
  > are number of collaborators You have any idea how easy it is to fake it? Also, snyk doesn't scan code that isn't on github, because they are under the impression that all the code in the world is on github, so things like gnome.org, debian salsa or codeberg are completely ignored. So you won't get reliable data from snyk. edit: snyk doesn't scan code at all, they rely on unrelated "metrics" to give a rating that is not very useful.

dalton_zk 2y ago

Literally a test in production. The dev commit their work go to home thinking "not will happen"

Sophira 2y ago
If it was really a test, then why would it be sending environment variables via HTTP POST? There are many better ways to do this if you're legitimately deploying code remotely.

hollowturtle 2y ago

Looks like NPM is generating jobs for those in the security field. It’s an unfixable mess, I really hope some competition like JSR will put enough pressure on the organization.

devjab 2y ago
It's not just NPM, it's the trust in third party libraries in general. Even though it's much rarer, you'll see exploits on platforms like Nuget. You're also going to see them on JSR. You have more security because they are immutable, but you're not protected from downloading a malicious pacakge before it's outed. I think what we're more likely to see is that leglislation like DORA and NSIS increasinly require that you audit third party packages. This enforcing a different way of doing development in critical industries. I also think you're going to see a lot less usage of external packages in the age of LLM's. Because why would you pull an external package to generate something like your OpenAPI specification when any LLM can write a cli script that does it for you in an hour or two of configuring it to your needs? Similarily, you don't need to use LLM's directly to auto-generate "boring" parts of your code, you can have them build cli tools which does it. That way you're not relying on outside factors, and while I can almost guarantee that these cli tools will be horrible cowboy code, their output will be what you refine the tools to make. With languages like Go pushing everything you need in their standard packages, you're looking at a world where you can do a lot of things with nothing but the standard library very easily.
- guappa 2y ago
  I think NPM makes it worse because it's common to have hundreds, or thousands of dependencies. Which makes it easier to hide a malicious one in there.

jijji 2y ago

npm is rife with this activity, its like wordpress plugins

mrweasel 2y ago
As much as I don't like NPM, these issues aren't limited to NPM. It's just that NPM is getting so much attention that we're more likely to find and hear about these issues when when they target NPM. I'm fairly concerned about the state of Python packages. It's not every week, but I frequently stumble upon packages that are not what they appear to be. Sometimes not maliciously, sometimes the author just got overly ambitious and failed to deliver, other times, someone is clearly typo-squatting or attempting to get you to install the wrong thing.

supriyo-biswas 2y ago

Is there a link for the "githax" tool shown in the blog post, which seems to be quite useful? There's [1] but it's just a banner image. [1] https://www.githax.com/ https://www.githax.com/

edm0nd 2y ago
The dev is https://github.com/6mile https://github.com/6mile (same as author of the article) seems to be either a tool that isnt out yet or perhaps not available for free or the public.
- 6mile 2y ago
  GitHax is a labour of love right now and is in heavy development. I'm going to create a small beta testing group soon. Hit me up if you want to be in that group. Contact deets are in my GH profile.

PoppinFreshDo 2y ago

I'm sure it's all part of some tiktok prank video.

sneak 2y ago

Side note: Snyk (founded 2015, computer and network security) has nothing to do with @sneak (hacking since 1998, computer and network security). I was dismayed to learn about their choice of brand, and think it might cause confusion. :(

vips7L 2y ago
I don’t even read those the same. To me snyk is read as snick and not sneak.
rdegges 2y ago
The name 'snyk' is an acronym, it stands for 'so now you know' (about security vulnerabilities) =D

raybb 2y ago

[flagged]

hu3 2y ago

A colleague of mine vendors npm dependencies to diff code between third party lib changes. Those are also covered in pull request reviews. Helps in cases like this.

absqueued 2y ago
Could you please explain a little more. I can use such practice in my dev workflow.
- hu3 2y ago
  Sure. They don't include "node_modules" directory in their .gitignore file. So any third party code changes end up in git commits and are easily visible and reviweable. So running npm update/upgrade includes the code that changed in the dependencies in the commit.
  - MortyWaves 2y ago
    Surely there has to be better ways of “vendoring” (including hosting your own package repository that doesn’t automatically pull new versions) than adding thousands or maybe tens of thousands of files to the git repo?
    - compootr 2y ago
      if it's dumb and it works it isn't dumb! another rather simple solution is a git mirror of each package, then point npm to a git url
    - xdennis 2y ago
      If my podcast memory serves, that's how Isaac (the NPM guy) said it was intended. You would `npm install` and then `git commit`. That's why npm didn't have a lock file back then. Git was the lock file.
    - guappa 2y ago
      On debian I do debdiff to see the differences between two source packages.

tankster 2y ago

Also interestingly the Snyk cofounder has started a competitor to cursor https://www.tessl.io/ https://www.tessl.io/ https://techcrunch.com/2024/11/14/tessl-raises-125m-at-at-500m-valuation-to-build-ai-that-writes-and-maintains-code/ https://techcrunch.com/2024/11/14/tessl-raises-125m-at-at-50... I hope there is no foul play.

guappa 2y ago
Given how all my interactions with them have been extremely negative (see my other comment), I think it's rather likely that there is foul play.

deleted 2y ago

[deleted]

guappa 2y ago

snyk is the same company that instead of rotating oublic keys just… changes them without notice. https://github.com/snyk/cli/pull/5649 https://github.com/snyk/cli/pull/5649 They also mark projects as "abandoned" if they move to any other forge that isn't github. And they stay abandoned even if new releases appear on npm/pypi :D Their competence isn't as big as their fame, in my opinion. Also one of their sales people insulted me over email, because apparently not being interested in buying their product means you're an incompetent developer who can only write software filled with vulnerabilities.

gyoridavid 2y ago
"insulted me over email" - whoa, that's wild, do you still have the email? would be fun to see it :D
- guappa 2y ago
  Sorry, I searched, it seems all my emails from before the last company rename are gone. edit: or microsoft outlook sucks… I tried to sort in reverse my inbox to see what's the oldest email there and "the request cannot be satisfied"
  - unixhero 2y ago
    Ouch, I kind of trusted it. ... more than Gmail and Google
- ceejayoz 2y ago
  I get surprisingly many cold emails these days with a passive aggressive “shall we schedule a call, or are you a bad person who doesn’t give a shit about security?” approach.
  - matwood 2y ago
    Yeah. Or 'make this change to help our processes'. Um, that's not my job.
2y ago

bugtodiffer 2y ago

We have read this exact story before, please learn not to leak too much sensitive data with your PoCs

gunnarmorling 2y ago

In the Java world, you need to prove ownership of a given namespace (group id), e.g. via a TXT record for that domain. Isn't there a similar concept for NPM? The package is named sn4k-s3c/call-home, how will a victim be tricked into referencing that namespace sn4k-s3c (which I suppose is owned by the attacker, not Cursor)? I feel like I'm missing part of the picture here.

hennell 2y ago
You're not really missing anything so much as adding a misguided assumption of competence to NPM. Npm doesn't really do namespaces. There's just no ownership to prove as most packages are published like "call-home" with no namespace required. This gives exciting opportunities for you to register cal-home to trap users who miss type, or caII-home to innocuously add to your own or open source projects or whatever. Fun isn't it? In this case the call home package is namespaced, but the real attack is the packages like "cursor-always-local" which has no namespace. Which can sometimes (?) take precedence over a private package with the same name. It's not a pretty picture, you were better off missing it really.
- Vaguely2178 2y ago
  > Npm doesn't really do namespaces. Yes it really does. npm has namespaces (called scoped packages) and even explicitly encourages their use for private packages to avoid this sort of attack. From the npm docs: "A variant of this attack is when a public package is registered with the same name of a private package that an organization is using. We strongly encourage using scoped packages to ensure that a private package isn’t being substituted with one from the public registry." [1] > This gives exciting opportunities for you to register cal-home to trap users who miss type, or caII-home to innocuously add to your own or open source projects or whatever. Fun isn't it? npm actively blocks typo-squatting attacks during the publishing process: "Attackers may attempt to trick others into installing a malicious package by registering a package with a similar name to a popular package, in hopes that people will mistype or otherwise confuse the two. npm is able to detect typosquat attacks and block the publishing of these packages." [1] This thread is full of people demonstrating the concept of confirmation bias. [1] https://docs.npmjs.com/threats-and-mitigations https://docs.npmjs.com/threats-and-mitigations

stuaxo 2y ago

"It's a good idea not to use npm packages blindly" Yes, but also impractical.

justmarc 2y ago

[flagged]

cheema33 2y ago
> Yawn. Wrong forum perhaps? Or wrong story? But you clicked the story. Read it. And then even bothered to comment on it. You are putting a lot of effort into something that does not interest you.

skirge 2y ago

"no one can hack us" and then "you can't hack us, how dare you" game, 25 years and more

cheema33 2y ago
> "no one can hack us" Did Cursor made claims to this effect and invited public to hack them? Or are you equating someone saying they "take security seriously" to "it's an open season, please attack our systems."?
- skirge 2y ago
  yes it is, like independent product reviews or crash tests of cars. Anyway Kim Jong Un doesn't care.

deleted 2y ago

[deleted]

SebFender 2y ago

Behind hundreds of builds Snyk has been a challenging integration that ultimately creates very low value. I recommend using a decent team that goes in for flow weaknesses as these are most responsible for significant findings...

fintechie 2y ago

Hopefully this makes the Cursor team reconsider security (which doesn't seem very good really). Stopped using it for serious stuff after I noticed their LLMs grabs your whole .env files and sends them to their server... even after you add them to their .cursorignore file. Bizarre stuff. Now imagine a bad actor exploiting this... recipe for disaster.

miohtama 2y ago
Security often means the opposite of scalability and growth, so why should they? The business goal is to make sure Cursor grows large enough that they have economics of scale to be a viable business. If you want secure LLM you can use Mistral, which comes with all the EU limitations, good and bad.
- yunwal 2y ago
  Mistral (an LLM company) is not really a substitute for cursor (an IDE). Tabby is probably the closest open-source alternative. https://github.com/TabbyML/tabby https://github.com/TabbyML/tabby

jtdev 2y ago

[dead]

deleted 2y ago

[deleted]

dannyallan 2y ago

Snyk Research Labs regularly contributes back to the community with testing and research of common software packages. This particular research into Cursor was not intended to be malicious and included Snyk Research Labs and the contact information of the researcher. We were very specifically looking at dependency confusion in some VS Code extensions. The packages would not be installed directly by a developer. Snyk does follow a responsible disclosure policy and while no one picked this package up, had anyone done so, we would have immediately followed up with them.

senorrib 2y ago
Cool. Why phone home the user's environment, then? The vulnerability could very much be confirmed by simply sending a stub instead of live envs.
etyp 2y ago
Seems reasonable enough, but why would it (allegedly) send environment variables back via a POST? Even if it's entirely in good faith, I'd rather some random package not have my `env` output..
- guappa 2y ago
  Not allegedly. They confirmed it themselves. https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/ https://snyk.io/blog/snyk-security-labs-testing-update-curso...
yabones 2y ago
This is grey-hat at best. Intent may have been good, but the fact is that this team created and distributed software to access and exfiltrate data without permission which is very illegal. You may want to consult with the legal department before posting about this on a public forum fyi.
deleted 2y ago
[deleted]
luma 2y ago

gortok 2y ago

The only part of the article I disagree with is this line: > But in general, it’s a good idea not to install NPM packages blindly. If you know what to look for, there are definite signals that these packages are dodgy. All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not. This works -- maybe OK for top-level packages. But for transitive dependencies it's nearly impossible to vet every transitive dependency. If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? https://gist.github.com/anvaka/8e8fa57c7ee1350e3491#top-1000-packages-with-most-dependencies https://gist.github.com/anvaka/8e8fa57c7ee1350e3491#top-1000...

ziddoap 2y ago
>If you're pulling in a package that has 400 dependencies, how the heck would you even competently check 10% of that surface area? This would be where different security advice would apply: don't pull in a package that has 400 dependencies.
- krainboltgreene 2y ago
  Given the nature of software development and software developers, especially given American companies decide to value shareholder profits over programmer productivity, this might as well be effectively "You don't need to get vaccines, simply don't get sick from other people."
  - nightpool 2y ago
    Out of curiosity, I've always meant to ask, are you related to the famous Geoguesser content creator in any way? It's a pretty distinctive last name.
    - krainboltgreene 2y ago
      I believe he might be a distant cousin. I've done some family tree searching myself and haven't found many things, since the Rainbolt side has mostly been scoundrels and vagabonds there aren't many details, but we do have a mountain that we named after ourselves after we stole it from natives.

kittikitti 2y ago

NPM packages are the most bloated and unreadable pieces of code I've encountered. The creator of Node apparently hates all software and yet Google gave him the captain's hat and we're left with the absolute crap shoot that is web development. I feel guilty with an additional 1KB of code or 500 bytes of RAM but this is seen as an outsider opinion. I hope big tech rots and this is just a symptom. https://news.ycombinator.com/item?id=3055154 https://news.ycombinator.com/item?id=3055154

zelphirkalt 2y ago
NPM packages VS Wordpress plugins ... I think it is a head to head race there.

jdthedisciple 2y ago

Seriously: How do we know there aren't dozens or hundreds of comprimsed npm packages installed on every other server out there at this point? Think xz-utils but even much less sophisticated exploits. I don't see any systematic protection against this?

cko 2y ago
> I don't see any systematic protection against this? Snyk
- guappa 2y ago
  Ah yes, add malware and sell malware detection. The perfect business idea.

rdegges 2y ago

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/ https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cursor, but found no vulnerabilities. There's no malicious intent or action here, but I can certainly understand how it appears when there's not a ton of information and things like this occur! As a sidenote, I use Cursor all the time and love it <3

rettichschnidi 2y ago
Sorry, but you screwed up royally. Scary to see that Snyk still does not see this. Ethically, your work was even lower than that of those who test their AI tools on FOSS code, send in bogus reports and thus waste maintainer's time. Experimenting on unwitting humans and ecosystems is not okay.
guappa 2y ago
> The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables. And exfiltration was needed to confirm a vulnerability why exactly? I love how completely unaware you guys are.