Malicious MemTensor Packages on npm and PyPI Deliver sckit Credential Stealer
Threat actors compromised legitimate MemTensor packages on npm and PyPI, distributing a Go-based implant named sckit that targets Windows, Linux, and macOS systems.
Unknown threat actors have successfully infiltrated the npm and Python Package Index (PyPI) repositories by compromising legitimate MemTensor packages. These compromised packages were used to distribute a sophisticated Go-based implant, dubbed 'sckit,' designed to operate across Windows, Linux, and macOS environments. The malicious activity was identified in specific versions of the @memtensor/memos-cloud-openclaw-plugin package on npm and the MemoryOS package on PyPI.
According to security researchers from Aikido, SafeDep, Socket, and StepSecurity, the affected npm package versions are @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25. Versions 0.1.22 and 0.1.24 were found to be clean. On PyPI, the compromised package is MemoryOS version 2.0.34, which has since been quarantined. The malicious npm packages embed a Go payload within legitimate AI memory integration code. This payload is designed to launch when the agent gateway starts and, critically, whenever the plugin handles a memory-recall event, passing sensitive host process environment details and user prompts directly to the malicious executable.
The PyPI variant operates similarly, initiating the statically-linked Go binary as soon as the memos module is imported into an application. Regardless of the initial entry point, the ultimate objective of the sckit implant is to harvest credentials from cloud services, source-code platforms, package registries, and developer tools. The stolen data is then exfiltrated to a remote command-and-control server located at skyleen[.]fr.
The scope of data targeted by sckit is extensive, encompassing sensitive information such as credential files (e.g., .npmrc, .vault-token, id_ecdsa), environment variables containing tokens, passwords, API keys, private keys, session cookies, and database connection strings. It also specifically targets AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face keys, HashiCorp Vault secrets, Slack and Stripe API keys, SendGrid keys, and JSON Web Tokens (JWTs).
Analysis by SafeDep suggests that the attackers gained access to MemTensor's publish tokens by exploiting GitHub Actions release pipelines. They achieved this by pushing commits that manipulated the workflow to inadvertently expose the npm or PyPI tokens. The sckit implant exhibits worm-like capabilities, potentially self-proliferating by publishing itself to other npm and PyPI packages and through GitHub. It remains unclear if other packages beyond MemTensor have been compromised.
The implant is designed to collect credentials from both developer machines and CI/CD jobs. It communicates with a command-and-control server to receive signed tasks and includes templates for injecting itself into npm packages, Python packages, and GitHub Actions workflows. This multi-faceted approach allows the malware to spread and maintain persistence across various development environments.
Given that malicious versions of the npm packages are still available, users are strongly advised to pin their dependencies to safe baseline versions (0.1.20 for the npm package, 2.0.33 for the PyPI package). Additionally, it is crucial to rotate any exposed secrets, terminate any running sckit processes, and block the C2 domain skyleen[.]fr and all its subdomains to mitigate the risk of further compromise.
The MemOS Cloud plugin's normal function involves integrating the OpenClaw agent runtime with a memory service, handling memory recall before prompt processing and adding memories post-run. This integration places the plugin within processes that routinely handle user input and may inherit valuable credentials. On developer workstations, this can grant attackers access to cloud configurations, source repositories, publishing tokens, and application secrets, while in automation environments, it can lead to the compromise of injected credentials for specific jobs.