Developers using MemTensor packages from npm and PyPI are at risk after threat actors compromised two official packages to deliver a Go-based implant called sckit, capable of stealing credentials across Windows, Linux, and macOS systems. The malicious versions were found in specific plugin libraries, while unaffected versions remain clean—users are urged to act swiftly.
The Compromise Explained
Attackers gained control over two MemTensor packages:
- The npm package
@memtensor/memos-cloud-openclaw-pluginin versions 0.1.21, 0.1.23, and 0.1.25 had a hidden Go payload; versions 0.1.22 and 0.1.24 were clean. Upon startup of the associated agent gateway or during memory-recall events, it launches the malicious executable. - The PyPI package
MemoryOSversion 2.0.34 was also compromised. It activates the Go binary as soon as the “memos” module is imported into code. The project has since been quarantined on PyPI.
Both compromised libraries echo with similar intent: to harvest sensitive credentials—including token files, configuration files, private keys and session cookies—from cloud services, source code platforms, package registries, and developer tooling. In particular, the implant exfiltrates data to the domain skyleen[.]fr.
How It Works
The attackers reportedly secured the npm and PyPI publish tokens by injecting malicious commits into MemTensor’s GitHub Actions release workflows. These workflows were used to automate package releases, and the actors abused them to push out compromised versions. Once deployed, the implant functions much like a worm: it can spread through package publications on npm and PyPI, and also embed itself into GitHub Actions workflows. It collects credentials from development machines and CI environments, receiving signed instructions from a command-and-control (C2) server to perform further actions.
The credential harvesting includes: environment variables that expose tokens and API keys, files like .npmrc or id_ecdsa, cloud provider credentials, and sessions for services like GitHub, AWS, Vault, Slack, SendGrid, among others.
What Developers Should Do
To mitigate risk, developers should pin to safe package versions—npm version 0.1.20, or earlier, and PyPI version 2.0.33 or earlier—where no malicious payloads are present. It’s critical to rotate any exposed secrets immediately, kill any running sckit processes, and block communications with the domain skyleen[.]fr including any subdomains.
Further investigations are ongoing, and it’s not yet known whether other packages beyond MemTensor have been compromised.
This attack underscores a growing trend in supply-chain exploits: even trusted open-source AI-oriented tools are being weaponized. As more development depends on package registries and automated pipelines, the integrity of CI/CD workflows and package publishing mechanisms become high-value attack vectors.
