Skip to main content

Over 3,200 Cursor Users Infected by Malicious Credential-Stealing npm Packages

1 month ago
Cybersecurity researchers have flagged three malicious npm packages that target the macOS version of AI-powered code-editing tool Cursor, reports The Hacker News: "Disguised as developer tools offering 'the cheapest Cursor API,' these packages steal user credentials, fetch an encrypted payload from threat actor-controlled infrastructure, overwrite Cursor's main.js file, and disable auto-updates to maintain persistence," Socket researcher Kirill Boychenko said. All three packages continue to be available for download from the npm registry. "Aiide-cur" was first published on February 14, 2025... In total, the three packages have been downloaded over 3,200 times to date.... The findings point to an emerging trend where threat actors are using rogue npm packages as a way to introduce malicious modifications to other legitimate libraries or software already installed on developer systems... "By operating inside a legitimate parent process — an IDE or shared library — the malicious logic inherits the application's trust, maintains persistence even after the offending package is removed, and automatically gains whatever privileges that software holds, from API tokens and signing keys to outbound network access," Socket told The Hacker News. "This campaign highlights a growing supply chain threat, with threat actors increasingly using malicious patches to compromise trusted local software," Boychenko said. The npm packages "restart the application so that the patched code takes effect," letting the threat actor "execute arbitrary code within the context of the platform."

Read more of this story at Slashdot.

EditorDavid

How Spaceport America Will Grow

1 month ago
18 years ago Slashdot covered the creation of Spaceport America. Today Space.com hails it as "the first purpose-built commercial spaceport in the world." But engineer/executive director Scott McLaughlin has plans to grow even more. Already home to an array of commercial space industry tenants, such as Virgin Galactic, SpinLaunch, Up Aerospace, and Prismatic, Spaceport America is a "rocket-friendly environment of 6,000 square miles of restricted airspace, low population density, a 12,000-foot by 200-foot runway, vertical launch complexes, and about 340 days of sunshine and low humidity," the organization boasts on its website... Space.com: What changes do you see that make Spaceport America even more viable today? McLaughlin: I think opening ourselves up to doing different kinds of work. We're more like a civilian test range now. We've got high-altitude UAVs [Unmanned Aerial Vehicles]. We're willing to do engine production. We believe we're about to sign a data center, one that's able to provide services to our customers who want low-latency, artificial intelligence, or high-powered computing. You'll be able to rent some virtual machines and do your own thing and have it be instantaneous at the spaceport. So I think being more broadminded about what we can do at the spaceport is helping generate customers and revenue... Our goal is to see Virgin Galactic fly in a year or so, hopefully flying twice a week, and that will have a big impact on the spaceport... [W]e're trying to be open-minded as we're partnered with White Sands Missile Range to use that airspace. We're even looking at things like an electromagnetic pulse facility. It's a customer that I can't identify yet... We are working on a "reentry" license too. We recently discussed this with specialists and we think we have a site relatively close to the spaceport that's flat and free of mesquite bushes and such, so we can do capsule return and other types of return. And of course we have the runway. So I'd think we'd be the only spaceport that does vertical and horizontal launch and reentry.... We're never going to have the throughput that the Cape in Florida has. But we'll be a good alternative especially if you're going to do a small to medium-sized launch, and you need to do it quickly, and perhaps do it more securely than you would if you were to fly over water. That's why the Department of Defense is showing interest in the inland spaceport.

Read more of this story at Slashdot.

EditorDavid