Malicious MemTensor Packages Compromised to Deliver sckit Malware

Threat actors have compromised legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to distribute a cross-platform credential stealer known as sckit.

The malware is a Go-based implant designed to run on Windows, Linux, and macOS. Security researchers from Aikido, SafeDep, Socket, and StepSecurity identified the malicious versions, which aim to harvest sensitive data from developer environments and cloud services.

Affected Packages and Versions

The compromise affects specific versions of MemTensor-related libraries. It is important to note that certain intermediate versions remain unaffected.

• npm: @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 (versions 0.1.22 and 0.1.24 are confirmed clean).
• PyPI: MemoryOS version 2.0.34, which has been quarantined on the registry.

According to StepSecurity, the malicious npm package embeds a hidden Go payload into an AI memory integration. The payload is triggered when the agent gateway starts or during memory-recall events, at which point it passes host process environment details and user prompt text to the malicious executable.

In the PyPI ecosystem, the attack is triggered as soon as the “memos” module is imported into an application, which immediately executes the statically-linked Go binary.

Targeted Data and Propagation Risks

The sckit implant is designed to exfiltrate credentials to an external server, skyleen[.]fr. Research from Socket indicates that the malware targets a wide range of sensitive information, including:

• Cloud service access keys, such as AWS credentials.
• Source-code platform tokens from GitHub and GitLab.
• Package registry credentials for npm and PyPI.
• Environment variables containing API keys, private keys, or session cookies.
• Secrets from tools including HashiCorp Vault, Slack, Stripe, and SendGrid.

Research from SafeDep suggests the attackers gained access to MemTensor’s publishing tokens by exploiting GitHub Actions release pipelines, pushing commits that caused the workflows to hand over the necessary credentials. Furthermore, the implant has characteristics of a worm, with the capability to self-proliferate through GitHub, npm, and PyPI.

Mitigation and Remediation

To defend against this supply chain attack, developers and organisations are advised to take the following immediate actions:

• Pin package versions: Use version 0.1.20 for the npm package and version 2.0.33 for the PyPI package.
• Rotate secrets: Immediately rotate any credentials, API keys, or tokens that may have been exposed in CI/CD environments or on developer workstations.
• Terminate malicious processes: Identify and kill any active sckit processes on running systems.
• Network blocking: Block all traffic to skyleen[.]fr and its associated subdomains.