Snyk Blog

Are you familiar with https://snyk.io/? Disclaimer: I used to work with the founder, he’s great.

If you are looking for something that helps you keep your OSS packages secure, then Snyk[0] is doing an excellent job at it. [0] https://snyk.io

What do you use for CI? And yes, that is a great question. I would love to know. I guess, however, the follow-up question is how current the audit package is kept. It seems like this is the sort of thing that would need -constant- update in order to be useful. However, as is often the case, please do correct me if I am wrong. Edit: one of the folks from Snyk responded to me below: https://snyk.io/ This seems to be what they do. No endorsement, but this certainly seems interesting.

All great answers thus far. First, it is not for faint of heart. Second, if you get in door, learn how to say no as not every corporate customer is a good one - some can suck you dry and have you customize feature after feature so you need to be strong. As a previous commenter mentioned, understanding what your product is and your go-to-market motion is super important. Are you a bottom up developer or user-led adoption with ideas to expand or are you going pure top-down enterprise? Either will take time but I've worked with many a company that successfully went from bottom up and generated significant enterprise sales like https://Snyk.io. If you choose to go top down, find advisors or investors who have relationships at some of your corporate prospects. Going top down super early requires relationships to get in the door. Second, you have to figure out exactly who in the organization you need to get to and understand what is their pain and how you can uniquely solve it. I've seen way too many early stage founders get in the door to explore and they end up hunting for dodo birds - they're extinct and don't exist. There is so much more on this topic and one method I advocate is focusing on enterprise design partnerships vs. selling which has more of a partnering model than a transatcional one. More on that here in a SaaStr podcast I was on -…

These days compromised packages are often detected automatically by software that scans all packages uploaded to npm like https://socket.dev or https://snyk.io. So I imagine it's still useful to have those services scan these packages first, before they go out to the masses. Measures like this also aren't meant to be "final solutions" either, but stop-gaps. Slowing the spread can still be helpful when a large scale attack like this does occur. But I'm also not entirely sure how much that weighs against potentially slowing the discovery as well. Ultimately this is still a repository problem and not a package manager one. These are merely band-aids. The responsibility lies with npm (the repository) to implement proper solutions here. > The responsibility lies with

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-c… The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cursor, but found no vulnerabilities. There's no malicious intent or action here, but I can certainly understand how it appears when there's not a ton of information and things like this occur! As a sidenote, I use Cursor all the time and love it <3

I've found the best way to evaluate the quality of npm libraries is to use Snyk analyzer https://snyk.io/advisor/check/npm

Snyk webinar. "AI-assisted coding tools increase your delivery speed... and security risks. In the span of just one hour, we'll build a demo app using GitHub Copilot and ChatGPT, and live hack the results, showing how the generated code can be exploited." Further reading: https://snyk.io/blog/10-best-practices-for-securely-developing-with-ai… https://snyk.io/blog/addressing-risks-in-the-owasp-top-10-for-llms/

It is a great tool to create exploits playloads. For more understanding about the topic I recommend this: https://snyk.io/blog/serialization-and-deserialization-in-java/

Wow, awesome to see what you're working on with Socket. I feel it's a much-needed tool. One question though: how do you think https://socket.dev will compare to https://snyk.io/ and other similar tools? How do you differentiate yourself from competition in the space? (I've been a big fan of yours since early WebTorrent days.)

I think this is more of a demonstration of what trickest can do. I posted it because it made it onto GitHub trending and thought it shows the potential of what could be done by aggregating cve / POC data. I had much the same thought as you, it would be great to have this in a curated database. I feel like someone might reply that such a thing already exists :) Snyk is pretty good for your use case (I think). It often has PoCs or links to PoCs if they’re available for vulnerabilities associated with library / framework versions. Here’s the link to the vulnerabilities for Django: https://snyk.io/vuln/pip:django

I don't think Clojure was ever growing at a huge clip, but it seems to be doing about the same as Scala, see eg the pie at https://snyk.io/blog/kotlin-overtakes-scala-and-clojure-to-become-the-… Kotlin is just Java with improvements and it has major corporate push from Google, so it's natural for it to ride the big volumes. I think long term Clojure is going to keep doing well, despite modest pie slice of JVM dev, because lots of people continue to prefer its simplicity + dynamic FP + unique approach to data, plus the excellent ClojureScript side, and it doesn't really have competition or alternatives on the JVM (unlike Scala, where Kotlin/Java are co-opting features).

Original Title: "Snyk.io, a security manager, has a different site over HTTP" Other comment pointed out I can't read. Compare: http://synk.io/ And https://snyk.io/? What's going on here?

Seems like a competitor to https://snyk.io/ . Let's see when it comes out.

For anyone looking for something right now we are very much hiring over at https://snyk.io/ for engineers and more in Tel Aviv & London. All interviews are remote at this time but we are not stopping hiring. Here is a small description of what we do: Ecosystems Group My team is responsible for introducing support for new Languages, Build Tools and Package Managers to help Snyk users test & fix their projects. We do so by understanding the language rules & dependency resolution rules for each tool and building libraries & services in TypeScript that can extract project dependencies so that they can be tested for known vulnerabilities. Expect to learn a lot, pair a lot and be challenged while delivering incremental value to our users We use Node.js with Express & Typescript.

Keeping your autostart directory read-only is a great idea. After that, a ZIP symlink traversal could still drop a script in your command path directories that are writable by your user. The execute bit is not a hurdle, unzip utilities will typically preserve the execute bit on Unix systems. ZIP directory traversals are as old as the hills, yet they are still a thing: https://snyk.io/research/zip-slip-vulnerability. ZIP symlink traversals are even more powerful, yet they are hardly spoken of. Ideally, you want your email provider to be blocking ZIP attachments with symlink traversals or execute bits (but I am not aware of any which do).

OWASP dependency check (https://www.owasp.org/index.php/OWASP_Dependency_Check). (Java) Oh, and snyk for js: https://snyk.io/

Tools like Snyk are doing good work to try and solve this problem. https://snyk.io/

I can recommend Snyk[0] (I am not affiliated, have used their products with clients before). They've got a fully functional free tier, and they have a ton of relevant features. And yes, there are other, competing products out there you could use. [0] https://snyk.io/docs/snyk-for-python

Automated tooling is a must, yes. The riskiest part about relying on ONLY GH's solution (IMO) is the NVD/CVE limitation. I agree, CVE would be _awesome_ in theory. In reality, very few file for CVE's and so the coverage is iffy (~11% of npm package vulns and about ~67% of rubygem vulns https://snyk.io/stateofossecurity/). But it goes beyond that. There was a great paper earlier this year (https://arxiv.org/abs/1705.05347) that highlighted many other issues: lag between CVE and NVD (which is where all the useful info comes from), mismatched CPE's, nonexistent CPE's, etc. I would love to see us get to a point where the CVE/NVD was enough, but we're far from it right now.

Integrating something like https://nodesecurity.io/opensource or https://snyk.io into you're CI process will help flag issues you may want to know about if they are disclosed / discovered. And yes, I get the irony of adding another dependency to help with the security mess caused by the node ecosystem's bent towards external untrusted / unverified dependencies.

This article was very much about the data we've collected and our analysis of it, as opposed to our opinions as to why - had to keep it to a reasonable length! So we kept that section short in the end. I do plan follow up posts that provide my theories as to why it's happening, and I think a best practices guide that discusses template-related XSS is a good idea. In the meantime, you can check out this related post: https://snyk.io/blog/type-manipulation/

Snyk, the site hosting this article, provide such a service: https://snyk.io/

>Rubysec is awesome but outdated, lacks many of the vulnerabilities in https://Snyk.io/ I'm one of the Rubysec maintainers. If you're reading this and you know about vulns not present in the advisory-db, please submit a PR to the github repo, or use the crappy form we put together: https://rubysec.com/advisories/new I too run a vulnerability notification service, and it's frustrating when other people use public data but don't contribute back.

Yes, shrinkwrapp is a good solution to lock down your dependency versions. Regarding the security breaches, this is a big problem because, as you mention, there are huge chains of dependencies, and also some of the vulnerabilities are not even in your direct dependency - which makes it hard to fix vulnerabilities. Snyk recently released stats that found that 14% of npm packages carry known vulnerabilities. Also 64% of our users have found a vulnerability in a private repo, so the chance that your package also contains a vulnerable dependency is quite high.(I work there btw) We released an open source cli tool that helps you find and fix vulnerabilities in your dependencies tree. You are welcome to try it - https://snyk.io. You can also take a look at our open source vulnerabilities database with advisories and patches at https://github.com/Snyk/vulndb.

Snyk | https://snyk.io/ | Software Engineer, Senior Software Engineer, Engineering Manager | Full Time | Boston, MA or London, UK | Onsite / Hybrid About Snyk: Every day, the world gets more digital thanks to tens of millions of developers building the future faster than ever. But with exponential growth comes exponential risk, as outnumbered security teams struggle to secure mountains of code. This is where Snyk (pronounced “sneak”) comes in. Snyk is a developer security platform that makes it easy for development teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and cloud infrastructure — and do it all right from the start. Snyk is on a mission to make the world a more secure place by empowering developers to develop fast and stay secure. As an Engineer at Snyk, you'll be at the forefront of building the future of application security. You’ll be challenged to create high-performance, reliable, and scalable services while collaborating closely with cross-functional teams. We’re looking for individuals who are passionate about crafting exceptional software, solving complex problems, and driving innovation. As a part of our Developer Experience team you’ll have the opportunity to work on a wide range of projects, from mastering existing services to building new, cutting-edge features. Your contributions will directly impact the success of our product and the security of millions of developers worldwide. You can find this and…

Snyk | https://www.snyk.io/ | Cluj, London, Tel Aviv (all remote) | Full Time Selected job postings here: https://snyk.io/careers/all-jobs/?department=4051349002 === Every day, the world gets more digital thanks to tens of millions of developers building the future faster than ever. But with exponential growth comes exponential risk, as outnumbered security teams struggle to secure mountains of code. This is where Snyk (pronounced “sneak”) comes in. Snyk is a developer security platform that makes it easy for development teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and cloud infrastructure — and do it all right from the start. Snyk is on a mission to make the world a more secure place by empowering developers to develop fast and stay secure. If you are interested, please send your resume to [email protected] and include "HN: Who is Hiring" in the email subject line.

There's literally a web site of Kubernetes failure stories: https://k8s.af/ where people experienced in Kubernetes have shot themselves in the foot. To be fair, it's over a year old, and probably the state of the art and best practices have advanced to the point where many of these are unlikely to happen. But in general, Kubernetes is widely considered a very big complex thing full of footguns for the unwary for a reason. So while I agree with you that sure, you can get up and running by watching some videos and copy-pasting a few YAML files, the problem is when you are deep into critical production and you run into issues (the classic "I get woken up at 3am by an alert or my boss and we need to fix this in 10 minutes") and you lack the deeper understanding of the framework to even know where to start. Or even worse, you insert an insidious security issue through a misconfiguration and you are not even aware you have been owned. Security is notoriously difficult to get right, even for people with experience in frameworks and systems, let alone a newbie. Kubernetes is not "secure by default" and again, there are footguns for the unwary: https://snyk.io/learn/kubernetes-security/ None of these things make Kubernetes bad, per se, and I'm sure the benefits outweigh the costs. But personally I would be cautious about adopting it for serious production without having some solid real-world experience first.

This made me curious what type of vulnerabilities were in something like Lodash and the answer was mostly prototype overwriting: https://snyk.io/vuln/npm:lodash It’s nice to see the Snyk project contributing patches back into major open source projects, not just highlighting them. Even if the threat model is relatively mild for an average dev like myself working in a controlled environment, despite the fact the vuln gets marked as severe (don’t get me wrong, it is still important for the larger OSS projects that are widely deployed to a variety of environments like lodash). I’ve become far more careful updating JS libraries as most frontend projects have thousands in their package.json and I’ve had countless deployment issues getting ground down once the dependencies try to update in production, even though they worked fine locally. We have protocols to catch stuff like that but it’s still a headache that often takes far more effort than it’s worth to have a few patches (same with keeping a Docker clone of production locally which is another nest of problems). So I try to keep updates to dependencies like that contained in their own commits which can be rolled back, and not part of other feature branches or fixes. I don’t have this problem in other languages nearly as much as JS using NPM/yarn. So I tend to be far less eager to run ‘npm audit’ than I used to.

Very cool. How does this compare to Snyk? https://snyk.io