Malicious MemTensor packages spread sckit credential stealer

Unknown threat actors have compromised two legitimate MemTensor packages on npm, the JavaScript package registry, and the Python Package Index (PyPI), the official package repository for the Python programming language, to distribute the sckit credential stealer, a Go-based implant that steals developer credentials on Windows, Linux and macOS. The activity was reported by researchers at Aikido, SafeDep, Socket and StepSecurity. The affected packages are @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25, and MemoryOS version 2.0.34. Versions 0.1.22 and 0.1.24 of the npm package are clean, and the PyPI project was quarantined after the malicious version appeared.

StepSecurity explained that the malicious npm package versions hide a Go payload inside a legitimate AI memory integration. When the agent gateway starts, and whenever the plugin handles a memory-recall event, the code launches that payload. The launcher passes the host process environment, meaning the program can read the settings and variables available to the process it runs inside, and during memory recall it passes the user's prompt text directly to the malicious executable. The PyPI package behaves slightly differently: it starts a statically linked Go binary, a self-contained program file, as soon as the memos module is imported into an application. In both ecosystems the purpose is the same, to run a cross-platform credential-stealing program that collects data from cloud services, source-code platforms, package registries and developer tools and sends it to an external server at skyleen.fr.

Socket reported what the implant looks for. Its targets include npm, PyPI, GitHub, GitLab, AWS, Vault and SSH secrets. On an infected machine it searches for credential files such as .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens. It also examines environment variables, the small pieces of configuration data programs read from the computer, that point to tokens, passwords, API keys, private keys, session cookies and connection strings for databases or message brokers, including variables such as NPM_TOKEN and PYPI_API_TOKEN. The list of stolen material also covers AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid keys, and JWTs, which are short-lived digital access tickets.

SafeDep traced how the attacker obtained the publish tokens in what it described as a supply chain attack. According to SafeDep, the attacker obtained the publish tokens from MemTensor's own GitHub Actions release pipelines. GitHub Actions is a service that automates building, testing and releasing code. By pushing commits that caused the workflow to hand over the npm or PyPI token, the attacker gained the ability to publish the tampered package versions. SafeDep further noted that the implant can function like a worm: it can self-proliferate through GitHub and by directly publishing npm and PyPI packages. It collects credentials from developer machines and from CI jobs, which are automated build and test runs. It receives signed tasks from a command-and-control (C2) server, a machine run by the attackers that gives the implant instructions, and it contains templates to install itself in npm packages, Python packages and GitHub Actions workflows. At the time of the report it was unclear whether packages other than MemTensor had also been compromised.

StepSecurity provided more context about the legitimate function of the MemOS Cloud plugin, which normally connects the OpenClaw agent runtime to a memory service. It recalls relevant memories before an agent processes a prompt and adds memories after a run, and it declares integration points for the Clawdbot and Moltbot runtimes. That placement matters because the plugin runs inside a process that routinely handles user input and may inherit valuable credentials. On a developer workstation the same user account can often reach cloud configuration, source repositories, package publishing tokens and application secrets, and in automated jobs the process may receive credentials injected for that specific job.

The initial advisory gave immediate defensive steps. It recommended pinning the npm package to version 0.1.20 and the PyPI package to version 2.0.33 as safe baselines, rotating any exposed secrets, killing any sckit process, and blocking the domain skyleen.fr along with all its subdomains. An update to the reports later confirmed that the malicious versions had been taken down from both npm and PyPI, and it listed the latest clean versions as @memtensor/memos-cloud-openclaw-plugin version 0.1.24 and MemoryOS version 2.0.33. This supply chain compromise is a reminder that developer machines and automated release processes are attractive targets for attackers who want to move from one small package update into widely used cloud and code hosting accounts. For organisations that rely on third-party packages, a security-first IT and consulting service such as AEU-I can help review dependencies, tighten the way automation pipelines handle secrets and plan a containment response, though the immediate priority remains updating the affected packages and rotating credentials.