Top all-time · #232
Snyk
Company blog · snyk.io/blog · on HN as gio_snyk_iosecurityprogramming
Snyk is the company blog at snyk.io, writing about security and programming. Since 2015, 210 different Hacker News readers have linked it 386 times, most often “Fix and prevent known vulnerabilities in Node.js and Ruby apps”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Rarely recommended · 1 of 40 sampled comments recommend it?
Why HN links it
HN readers link Snyk's blog and vulnerability database as sources on npm malware, supply-chain attacks, and JVM ecosystem stats, and its security research posts. Many links are to its tools and vuln pages.
- Recommended for · 1 comments
- Points readers to its article on the peacenotwar npm node-ipc malware as one for anyone interested.1
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the apps it builds. Get started for free or book a demo.
Most-linked posts?
- Fix and prevent known vulnerabilities in Node.js and Ruby apps14 people · 14 mentions · first linked 2017-03-09
- Snyk.io – Find and fix known vulnerabilities in Node.js dependencies9 people · 9 mentions · first linked 2015-12-07
- NPM package compromised by author: erases files on RU / BY computers on install7 people · 9 mentions · first linked 2022-03-16
- JVM Ecosystem Report 2018 – biggest ever JVM survey5 people · 6 mentions · first linked 2018-10-17
- The 2017 State of Open Source Security from Snyk5 people · 6 mentions · first linked 2017-11-16
- Kotlin becomes second most popular language on the JVM4 people · 8 mentions · first linked 2020-02-05
- Using Node.js Event Loop for Timing Attacks4 people · 4 mentions · first linked 2016-02-17
- Snyk Open Source Advisor – Snyk4 people · 4 mentions · first linked 2021-03-08
- Snyk Security Labs Testing Update: Cursor.com AI Code Editor3 people · 4 mentions · first linked 2025-01-14
- The MongoDB hack and the importance of secure defaults3 people · 4 mentions · first linked 2017-01-11
What Hacker News says?
Snyk added a 'test-unpublished' command to check all dependencies, but "is currently limited only to the packages Azer just unpublished, as opposed to all unpublished packages." https://snyk.io/blog/testing-for-unpublished-packages/
Comment linking /blog/testing-for-unpublished-packages/
on “I've Just Liberated My Modules”Submitted The most popular docker images each contain at least 30 vulnerabilities as a story · 562 points
HN discussionThese days compromised packages are often detected automatically by software that scans all packages uploaded to npm like https://socket.dev or https://snyk.io . So I imagine it's still useful to have those services scan these packages first, before they go out to the masses. Measures like this also aren't meant to be "final solutions" either, but stop-gaps. Slowing the spread can still be helpful when a large scale…
Comment linking /
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted NPM package compromised by author: erases files on RU / BY computers on install as a story · 312 points
HN discussionSounds like Snyk: https://snyk.io/
Comment linking /
on “Backdoor in event-stream library dependency”Submitted The MongoDB hack and the importance of secure defaults as a story · 282 points
HN discussionProtip to anyone using Mermaid.js Don't. It's a sea shanty of XSS vulns. https://snyk.io/vuln/npm%3Amermaid
Comment linking /vuln/npm%3Amermaid
on “Include diagrams in your Markdown files with Mermaid”Submitted NPM lockfiles can be a security blindspot for injecting malicious modules in PRs as a story · 259 points
HN discussionFor anyone looking for something right now we are very much hiring over at https://snyk.io/ for engineers and more in Tel Aviv & London. All interviews are remote at this time but we are not stopping hiring. Here is a small description of what we do: Ecosystems Group My team is responsible for introducing support for new Languages, Build Tools and Package Managers to help Snyk users test & fix their projects. We do…
Comment linking /
on “Ask HN: Have you been laid off?”Submitted Open source maintainer pulls the plug on NPM packages colors and faker as a story · 215 points
HN discussionAutomated tooling is a must, yes. The riskiest part about relying on ONLY GH's solution (IMO) is the NVD/CVE limitation. I agree, CVE would be _awesome_ in theory. In reality, very few file for CVE's and so the coverage is iffy (~11% of npm package vulns and about ~67% of rubygem vulns https://snyk.io/stateofossecurity/ ). But it goes beyond that. There was a great paper earlier this year ( https://arxiv.org/abs/170…
Comment linking /stateofossecurity/
on “Security alerts on GitHub”Submitted Kotlin becomes second most popular language on the JVM as a story · 192 points
HN discussionI've found the best way to evaluate the quality of npm libraries is to use Snyk analyzer https://snyk.io/advisor/check/npm
Comment linking /advisor/check/npm
on “Why is it so hard to buy things that work well? (2022)”Submitted Abusing Ubuntu 24.04 features for root privilege escalation as a story · 189 points
HN discussion> So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point. Sure, I already did. I earned the second highest bounty for Fastmail back in 2019 for exactly this kind of exploit. Since then I've reported to dozens of programs (OpenSSL, ClamAV, SpamAssassin, ProtonMail, Hey, Missive, Yahoo Mail, Yandex, Spark, Trello, Missive, AWS, Google Chrome) and rolled in a few tidy piles. I h…
Comment linking /blog/how-to-crash-an-email-server-with-a-single-email/
on “Can I Email?”Submitted The Frequency of Known Vulnerabilities in JavaScript as a story · 170 points
HN discussionIntegrating something like https://nodesecurity.io/opensource or https://snyk.io into you're CI process will help flag issues you may want to know about if they are disclosed / discovered. And yes, I get the irony of adding another dependency to help with the security mess caused by the node ecosystem's bent towards external untrusted / unverified dependencies.
Comment linking /
on “Malicious crossenv package on npm”Submitted Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem as a story · 147 points
HN discussionNot allegedly. They confirmed it themselves. https://snyk.io/blog/snyk-security-labs-testing-update-curso...
Comment linking /blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/
on “Snyk security researcher deploys malicious NPM packages targeting cursor.com”Submitted HTTPS Adoption doubled this year as a story · 139 points
HN discussionHey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cu…
Comment linking /blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/
on “Snyk security researcher deploys malicious NPM packages targeting cursor.com”Submitted Serverless security implications from infra to OWASP as a story · 114 points
HN discussionHey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-curso...
Comment linking /blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/
on “Snyk security researcher deploys malicious NPM packages targeting cursor.com”Submitted Looking at how many sites use vulnerable JavaScript libraries as a story · 108 points
HN discussion[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them] Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0]. Assumably, this Snyk employee either found or suspected that some part of Cursor's build is mis…
Comment linking /blog/detect-prevent-dependency-confusion-attacks-npm-supply-chain-security/
on “Snyk security researcher deploys malicious NPM packages targeting cursor.com”Submitted Building a backdoor with Node.js as a story · 103 points
HN discussionAt Snyk ( https://snyk.io ) we're actually working on a new blog process to refine this. Essentially, a problem almost every technical blog has is: when we publish articles, are they ephemeral -- or are they evergreen? If you treat blog posts as ephemeral, it means you'll write them once, ensure they're accurate, then leave them there forever. Unfortunately, with technology stuff, that rarely works. Technologies cha…
Comment linking /
on “Ask HN: Is the past disappearing on the web?”Submitted SourMint Malicious SDK as a story · 102 points
HN discussionGlass houses: https://snyk.io/vuln/npm:lodash@4.17.15 / http://ariagno.com/spotify/
Comment linking /vuln/npm:lodash@4.17.15
on “Log4j: Between a rock and a hard place”Submitted How to crash an email server with a single email (2018) as a story · 98 points
HN discussion
