Ethical Hacking News
Compromised MemTensor packages have been found to deliver a malicious credential stealer that can steal sensitive data from cloud services, source-code platforms, package registries, and developer tools, and exfiltrate the details to an external server. To protect yourself, pin packages to safe baseline versions, rotate exposed secrets, kill sckit processes, and block malicious domains.
The MemTensor packages hosted on npm and PyPI repositories have been compromised with a malicious credential stealer called "sckit". The sckit implant can steal sensitive data from cloud services, source-code platforms, package registries, and developer tools. The malicious versions of the packages are versions 0.1.21, 0.1.23, and 0.1.25 of the @memtensor/memos-cloud-openclaw-plugin and MemoryOS version 2.0.34. The sckit implant starts launching its payload when the agent gateway starts and whenever the plugin handles a memory-recall event. The implant can also self-proliferate through GitHub and direct npm and PyPI package publishing, making it a worm. The targets of the sckit implant include npm, PyPI, GitHub, GitLab, AWS, Vault, and SSH secrets, as well as environment variables. Developers and users must pin packages to safe baseline versions, rotate exposed secrets, kill sckit processes, and block malicious domains to reduce the risk of falling victim to this threat.
The threat landscape of cloud security has recently taken an ominous turn with the discovery of a malicious credential stealer that has been injected into MemTensor packages hosted on the npm and PyPI repositories. The compromised MemTensor packages have been found to deliver a platform-specific Go-based implant dubbed "sckit" that is capable of stealing sensitive data from cloud services, source-code platforms, package registries, and developer tools, and exfiltrating the details to an external server.
The discovery of this malicious implant was made by threat intelligence experts from various reputable sources, including Aikido, SafeDep, Socket, and StepSecurity. The compromised MemTensor packages in question are versions 0.1.21, 0.1.23, and 0.1.25 of the @memtensor/memos-cloud-openclaw-plugin, as well as MemoryOS version 2.0.34. The malicious versions of the npm packages are found to contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event.
The compromised PyPI package, on the other hand, starts the statically-linked Go binary as soon as the "memos" module is imported into an application. Regardless of the ecosystem targeted, the end goal of the sckit implant is to launch a cross-platform credential-stealing payload capable of harvesting sensitive data from various sources and exfiltrating the details to an external server.
The targets of the sckit implant include npm, PyPI, GitHub, GitLab, AWS, Vault, and SSH secrets, as well as environment variables that indicate tokens, passwords, API keys, private keys, session cookies, and database or message-broker connection strings. The implant is also capable of functioning like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing.
According to SafeDep, the attacker obtained the publish tokens from MemTensor's own GitHub Actions release pipelines by pushing commits that caused the workflow to hand over the npm or PyPI token. A deeper examination of the implant suggests that it can collect credentials from developer machines and from CI jobs, receive signed tasks from a command-and-control server, and contain templates to install itself in npm packages, Python packages, and GitHub Actions workflows.
Given the availability of the malicious versions of the npm packages, it is essential to pin the packages to a safe baseline version (0.1.20 for the npm package, 2.0.33 for the PyPI package) and rotate exposed secrets. It is also crucial to kill any sckit process and block "skyleen[.]fr" and all its subdomains.
The MemOS Cloud plugin connects the OpenClaw agent runtime to a memory service, which places the plugin inside a process that routinely handles user input and may inherit valuable credentials. This makes it a prime target for the sckit implant, which can launch a cross-platform credential-stealing payload capable of harvesting sensitive data from cloud services, source-code platforms, package registries, and developer tools.
In conclusion, the discovery of the compromised MemTensor packages that deliver the sckit credential stealer via npm and PyPI highlights the critical importance of cloud security and open-source software. It is essential for developers and users to be vigilant and take proactive measures to protect themselves against this type of threat. By pinning packages to safe baseline versions, rotating exposed secrets, killing sckit processes, and blocking malicious domains, individuals can reduce the risk of falling victim to this malicious implant.
Related Information:
https://www.ethicalhackingnews.com/articles/Compromised-MemTensor-Packages-Deliver-sckit-Credential-Stealer-via-npm-and-PyPI-A-Threat-to-Cloud-Security-and-Open-Source-Software-ehn.shtml
https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html
https://utopiats.com/blog/compromised-memtensor-packages-deliver-sckit-credential-stealer-via-npm-and-pypi
Published: Wed Sep 23 11:42:39 2026 by llama3.2 3B Q4_K_M
