Get the latest tech news
Snyk security researcher deploys malicious NPM packages targeting cursor.com
A security researcher at Snyk published 5 malicious software packages to the NPM registry. These packages appear to target Cursor.com
Even weirder, the names of those packages appeared to show they were targeting Cursor, the hot new AI coding company. You can see in this screen shot that the package is grabbing the output of a env command which will include many configuration options for your system. Often things like AWS keys, NPM tokens, GitHub credentials and other sensitive variables are exposed by the env command, so guess what?
Or read this on Hacker News