MemTensor Packages Compromised to Spread Sckit Credential Stealer
Attackers hijacked npm and PyPI packages to inject a Go-based implant that steals developer credentials and spreads via CI pipelines.
Key points
- Malicious versions of MemTensor packages on npm and PyPI inject a Go-based implant called sckit.
- The malware steals credentials from cloud services, code repositories, and CI pipelines, exfiltrating them to skyleen[.]fr.
- Users should pin to safe versions 0.1.20 and 2.0.33, rotate secrets, and block the C2 domain.
Unknown threat actors have compromised two legitimate MemTensor packages on npm and PyPI to distribute a cross-platform implant named sckit. The malware targets Windows, Linux, and macOS, aiming to harvest sensitive credentials from developer environments and cloud services.
The compromise affects specific versions of the @memtensor/memos-cloud-openclaw-plugin and MemoryOS packages. According to The Hacker News, the attack leverages these trusted libraries to execute malicious code whenever the agent gateway starts or processes memory-recall events, effectively turning a standard AI integration into a data exfiltration tool.
How the malware executes and spreads
The sckit implant is a statically linked Go binary that launches automatically upon import or plugin initialization. It passes host environment variables and user prompt text directly to the malicious executable, allowing it to capture secrets without user interaction.
Security researchers note the malware can act like a worm. It receives signed tasks from a command-and-control server and contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows, potentially propagating the infection to other repositories.
Targets include cloud and code credentials
The attacker focuses on high-value assets such as AWS access keys, GitHub and GitLab tokens, and HashiCorp Vault secrets. It also scrapes environment variables for API keys, session cookies, and database connection strings, exfiltrating this data to an external server identified as skyleen[.]fr.
By targeting CI/CD pipelines, the malware can steal credentials injected for specific jobs. This means that even if a developer machine is clean, the automation infrastructure can become a source of leaked secrets, expanding the attack surface beyond individual workstations.
Immediate steps to secure your environment
Developers should immediately pin affected packages to safe baseline versions, specifically 0.1.20 for npm and 2.0.33 for PyPI. It is critical to rotate any exposed secrets, terminate active sckit processes, and block the command-and-control domain along with all its subdomains.
The trade-off for using automated release pipelines is that they can be exploited to hijack publish tokens. Organizations must audit their GitHub Actions workflows to ensure that commit-based triggers do not inadvertently expose npm or PyPI tokens to untrusted code.
