Compromised MemTensor packages deliver sckit credential stealer via npm and PyPI

September 23, 2026 at 06:52 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Unknown threat actors compromised two MemTensor packages on npm and PyPI to distribute a Go-based credential stealer called sckit. The malware harvests credentials from cloud services, source-code platforms, and developer tools, exfiltrating them to skyleen.fr. Malicious versions remain available for download.

Key Facts

Compromised npm package versions 0.1.21, 0.1.23, and 0.1.25 launch the sckit payload when the agent gateway starts and during memory-recall events.
The PyPI package MemoryOS version 2.0.34 starts the malicious binary as soon as the memos module is imported.
The implant targets credentials from npm, PyPI, GitHub, GitLab, AWS, Vault, and SSH, including .npmrc, .vault-token, and access_tokens.json files.
Attackers obtained publish tokens from MemTensor's GitHub Actions release pipelines by pushing commits that caused workflows to hand over npm or PyPI tokens.
SafeDep recommends pinning packages to safe versions 0.1.20 (npm) and 2.0.33 (PyPI), rotating exposed secrets, and blocking skyleen.fr.

Compromised Packages

Two legitimate MemTensor packages were compromised across npm and PyPI to distribute a Go-based implant called sckit. The npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 contain a hidden Go payload, while versions 0.1.22 and 0.1.24 are clean. The PyPI package MemoryOS version 2.0.34 is currently quarantined on PyPI. StepSecurity reported that the npm versions launch the payload when the agent gateway starts and whenever the plugin handles a memory-recall event. The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable.

Credential Theft and Exfiltration

The implant harvests sensitive data from cloud services, source-code platforms, package registries, and developer tools, exfiltrating details to skyleen.fr. Targeted credentials include .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json, and stored_tokens files. It also collects environment variables indicating tokens, passwords, API keys, private keys, session cookies, and database or message-broker connection strings. Specific targets include AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face, HashiCorp Vault, Slack, Stripe, SendGrid keys, and JWTs. SafeDep noted the implant can function like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing.

Attack Vector and Mitigation

SafeDep's analysis found that attackers obtained publish tokens from MemTensor's GitHub Actions release pipelines by pushing commits that caused workflows to hand over npm or PyPI tokens. The implant collects credentials from developer machines and CI jobs, receives signed tasks from a command-and-control server, and contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows. Malicious npm package versions remain available for download, so users should pin packages to safe baselines 0.1.20 for npm and 2.0.33 for PyPI. Organizations should rotate exposed secrets, kill any sckit process, and block skyleen.fr and all its subdomains.