Snyk deployed 'malicious' packages, claims infoseccer

Updated Developer security company Snyk is at the center of allegations concerning the possible targeting or testing of Cursor, an AI code editor company, using "malicious" packages uploaded to NPM. Paul McCarty, a security researcher at SourceCodeRed.com, said he made the "strange" finding during a malicious package detection routine. He claimed a user named "sn4k-s3c" had uploaded three packages that were later tagged as malicious and named in a way that seemingly targeted Cursor: cursor-retrieval cursor-always-local cursor-shadow-workspace "If you install any of these packages they will collect data about your system and send it to an attacker controlled web service," he claimed. The cursor-shadow-workspace package, for example, would capture outputs of an env command, he said. Secrets exposed by such commands include GitHub credentials, AWS keys, and NPM tokens, McCarty added, so they would be compromised if the package was run. He went on to say: "Now, typically, when we see packages like this, they are attempting to perform a dependency confusion attack on a specific company. I don't know if Cursor.com has a bug bounty program or a specific background. Still, I would suspect that Cursor has several NPM private packages named 'cursor-always-local,' 'cursor-retrieval,' and 'cursor-shadow-workspace.' The packages have since been removed from NPM, the open source JavaScript package library, but before they were, McCarty claimed the metadata indicated that an individual usin...