Snyk appears to deploy 'malicious' packages targeting Cursor for unknown reason

A researcher found three malicious NPM packages (cursor-retrieval, cursor-always-local, cursor-shadow-workspace) that purportedly collected system and environment data—including credentials, AWS keys, and NPM tokens—and sent it to an attacker-controlled service; metadata reportedly pointed to a Snyk.io email, the packages were removed, Snyk apologized, and Cursor says it did not engage Snyk, leaving attribution and intent unclear.