MemTensor package compromise distributes sckit credential stealer

Threat actors compromised legitimate MemTensor packages in the npm and Python Package Index (PyPI) ecosystems to distribute sckit, a Go-based credential-stealing implant for Windows, Linux and macOS. Affected releases are @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25, while versions 0.1.22 and 0.1.24 are clean. On PyPI, the affected package is MemoryOS version 2.0.34, which has been quarantined.

Reports from Aikido, SafeDep, Socket and StepSecurity describe a supply-chain incident that places malicious code inside software intended to connect AI agent workflows with memory services. The npm releases remain available for download, making version control and response work immediately relevant for teams that use the plugin.

Payload execution follows normal plugin activity

In the malicious npm versions, a hidden Go payload launches when the agent gateway starts and whenever the plugin processes a memory-recall event. StepSecurity said the launcher passes the host process environment to the executable and, during recall, also passes the user’s prompt text.

MemoryOS 2.0.34 takes a different execution path: its statically linked Go binary starts as soon as an application imports the memos module. Both delivery paths aim to run the same cross-platform implant in processes that may have access to developer and automation secrets.

The MemOS Cloud plugin normally connects the OpenClaw agent runtime to a memory service, retrieving relevant memories before a prompt is processed and adding memories after a run. It also declares integration points for Clawdbot and Moltbot. That role can put it alongside user input, cloud configuration and credentials supplied to a CI job.

Credentials and publishing paths are in scope

Socket identified targets including npm, PyPI, GitHub, GitLab, AWS, Vault and SSH secrets. The malware searches credential files such as .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored-token files, as well as environment variables indicating tokens, passwords, API keys, private keys, cookies and connection strings.

It can harvest AWS access keys; GitHub, GitLab, npm and PyPI tokens; and keys associated with Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid, along with JWTs. Collected details are exfiltrated to skyleen[.]fr. The broader risk resembles trusted software distribution channel abuse because trusted software distribution channels can become a path to credentials and further access.

SafeDep said the attackers obtained publishing tokens from MemTensor’s GitHub Actions release pipelines by pushing commits that caused workflows to provide npm or PyPI tokens. Its analysis also found signed task handling from a command-and-control server and templates for installing the implant in npm packages, Python packages and GitHub Actions workflows. The researchers said it may be capable of self-propagation through GitHub and direct npm and PyPI publishing, although additional affected packages have not been confirmed.

Immediate containment priorities

Teams using these packages should pin the npm dependency to version 0.1.20 and MemoryOS to version 2.0.33, rotate potentially exposed secrets, stop any sckit process and block skyleen[.]fr and its subdomains. The practical implication is to treat package publishing tokens and CI-injected credentials as potential exposure points, then review them alongside developer workstation secrets during containment.