Emerging ThreatsMalware & Ransomware

Malicious MemTensor Packages Spread sckit Credential Stealer via npm and PyPI

Analyst 207||Source: TheHackerNews
Software development workspace with laptop, terminal windows, and notes on a clean desk in a neutral-colored room with…

"The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable," StepSecurity warned.

Compromised MemTensor npm and PyPI packages

Multiple security firms reported that unknown threat actors compromised two legitimate MemTensor packages across npm and PyPI to distribute a credential-stealing implant. Reporting from Aikido, SafeDep, Socket and StepSecurity identifies the affected packages as the npm package @memtensor/memos-cloud-openclaw-plugin (malicious versions 0.1.21, 0.1.23 and 0.1.25; versions 0.1.22 and 0.1.24 are clean) and the PyPI package MemoryOS version 2.0.34 (the project is currently quarantined on PyPI).

sckit: a platform-specific, Go-based credential stealer

The implant delivered by the compromised packages is a platform-specific Go binary called sckit. StepSecurity described how the npm package hides a Go payload "into a legitimate AI memory integration" and that those malicious npm versions launch the payload both when the agent gateway starts and whenever the plugin handles a memory-recall event. For the PyPI package, the statically linked Go binary is started as soon as the "memos" module is imported into an application.

Socket's analysis lists a broad range of targets for sckit. The implant collects credential files including .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens; it also harvests environment variables that indicate tokens, passwords, API keys, private keys, session cookies and connection strings (for example, NPM_TOKEN and PYPI_API_TOKEN). Socket says the implant looks for AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face keys, HashiCorp Vault tokens, Slack, Stripe and SendGrid keys, and JWTs. Exfiltration is directed to an external server on the domain "skyleen[.]fr".

How attackers abused GitHub Actions and publishing pipelines

SafeDep's supply-chain analysis attributes the repository compromise to abuse of MemTensor's own GitHub Actions release pipelines. According to SafeDep, the attacker pushed commits that caused the workflows to hand over the npm or PyPI publish token. SafeDep also notes that the implant contains templates that allow it to install itself in npm packages, Python packages and GitHub Actions workflows, and that the implant can receive signed tasks from a command-and-control server.

Socket adds that the implant has features that enable self-proliferation: "A deeper examination of the implant suggests that it can function like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing." As of writing, the reports say it is unclear whether other packages beyond MemTensor have been impacted.

Immediate mitigation steps reported by analysts

  • Pin packages to a known-safe baseline: 0.1.20 for the npm package and 2.0.33 for the PyPI package, the advisories say.
  • Rotate exposed secrets and tokens that may have been harvested from developer machines or CI jobs.
  • Terminate any running sckit processes and block the domain "skyleen[.]fr" and all its subdomains to interrupt exfiltration.
  • Note that the malicious npm package versions remain available for download, so consumers should treat downloads of versions 0.1.21, 0.1.23 and 0.1.25 as compromised.

These immediate recommendations are drawn from the reporting and remediation guidance in the analyses published by StepSecurity and SafeDep.

What this means for developer teams, package maintainers, and CI owners

  • Developer teams: Because the npm plugin can inherit the host process environment and the PyPI package launches on module import, developers who run or import the affected packages must assume local credentials and CI-injected secrets could have been exposed and should rotate tokens and keys accordingly, per the advisories.
  • Package maintainers: The compromise demonstrates the risk of publish-token theft via CI workflows; maintainers should review release pipelines for unauthorized commits or workflow changes that could leak credentials, as described by SafeDep.
  • CI owners and automation managers: SafeDep and Socket emphasize that the implant targets both developer machines and CI jobs and contains templates to infect GitHub Actions workflows—monitoring and locking down workflow permissions and tokens are priorities implied by the reported attack vector.

Taken together, the reports from Aikido, SafeDep, Socket and StepSecurity describe a multi-stage supply-chain compromise that turned a legitimate AI memory integration into a delivery mechanism for a cross-platform credential stealer. Analysts note the immediate need to pin safe package versions, rotate any possibly exposed secrets, and interrupt the implant's command-and-control path; at the same time, it remains an open question whether the compromise is confined to MemTensor or part of a wider campaign that has not yet been fully enumerated.

Original reporting

Emerging ThreatsNpmPypiSupply ChainMalware OperationsCredential StealerSckitMemtensor
Related Intelligence

Continue Reading

AI Agents Fuel 600K Credit Card Heist, Infect 100+ Sites

AI Agents Fuel 600K Credit Card Heist, Infect 100+ Sites

In a massive heist, over 600,000 valid credit card details were stolen from online retailers using open-source AI agent frameworks to compromise at least 119 websites and deliver skimmer malware at scale. The alarming campaign, active since July, saw a concentrated burst of 105 attack waves in just five days, targeting major companies and leaving a trail of digital devastation.

Analyst 207
Elsevier Redirect Attack Exposes LAPSUS$ Revival

Elsevier Redirect Attack Exposes LAPSUS$ Revival

Students trying to access Elsevier's website were shocked to find themselves redirected to a notorious hacking group's leak page, sparking concerns over a possible security breach. The incident was quickly contained, but not before some users shared their alarming experiences on social media.

Analyst 207
Cluttered office desk with a Windows computer workstation near a window.

Malware Leverages AI Models to Decide Next Move

Meet CLOSEDQUORUM, a sneaky Windows implant that outsources its decisions to commercial AI services like DeepSeek and Google Gemini, allowing it to adapt and evolve its attacks in real-time. This clever malware sends a snapshot of its host environment to multiple AI models, then executes the action that gets the most votes.

Analyst 207
Network equipment and management consoles line a dimly lit operations center corridor.

Network Management Systems Targeted in Widespread Exploitation Efforts

In a recent surge of cyber threats, 158 security advisories were issued across 17 vendors, exposing 1,699 vulnerabilities, including 42 critical flaws that could be exploited remotely. This alarming trend highlights the growing risk to network management systems, with some vulnerabilities already added to the government's catalog of known threats.

Analyst 207