News for hackers. Stuff that matters.

A comment on Snyk security researcher deploys malicious NPM packages targeting Cursor.com. Parent comment

Re:Snyk security researcher deploys malicious NPM packages t... by xmodem on Tuesday January 14, 2025 @06:45AM (#42696130)
Cursor does not have a bug bounty though, and its hard to see how this constitutes anything other than a direct attack on them, their users, or both. "The incentive structure made me do it" does not justify acting like a criminal.
[ Parent | on HN ]
Re:Snyk security researcher deploys malicious NPM packages t... by px43 on Tuesday January 14, 2025 @08:12AM (#42696735)
> Cursor does not have a bug bounty

Shouldn't this alone be considered criminal negligence at this point? Cursor isn't some random open source project. It's a company that has funding, and subscriptions. Hell, I pay Cursor for a monthly subscription. Pretty incredible that they have no bounty program.

[ Parent | on HN ]
Re:Snyk security researcher deploys malicious NPM packages t... by britannio on Tuesday January 14, 2025 @08:35AM (#42696989)
The lack of a bug bounty program doesn't prohibit them from rewarding reported vulnerabilities.
[ Parent | on HN ]
Re:Snyk security researcher deploys malicious NPM packages t... by taskforcegemini on Tuesday January 14, 2025 @12:19PM (#42700368)
do they though?
[ Parent | on HN ]
Re:Snyk security researcher deploys malicious NPM packages t... by grajaganDev on Tuesday January 14, 2025 @08:22AM (#42696836)
Cursor asks researchers to report vulnerabilities to their GitHub security page.

The same incentive to show impact applies even without a paid bounty.

[ Parent | on HN ]