Unknown threat actors have compromised legitimate MemTensor packages distributed through npm and Python Package Index (PyPI), using them to deliver a cross platform malware implant designed to steal sensitive credentials from developer environments. Security researchers reported that the affected packages were modified to include a Go based payload known as sckit, which targets Windows, Linux, and macOS systems. The incident highlights ongoing risks associated with software supply chain attacks, where attackers attempt to compromise trusted development tools and libraries to reach a wider set of users. Reports from security firms including Aikido, SafeDep, Socket, and StepSecurity identified the affected packages and analyzed the behavior of the malicious components.
The compromised packages include the npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS. Researchers identified affected npm versions 0.1.21, 0.1.23, and 0.1.25, while versions 0.1.22 and 0.1.24 were reported as unaffected. The MemoryOS package version 2.0.34 was also identified as compromised and has since been quarantined on PyPI. According to StepSecurity’s analysis, the malicious npm versions contained a hidden Go payload integrated into a legitimate AI memory plugin. The payload was designed to launch when the agent gateway starts and during certain memory recall operations. Researchers noted that the malicious component could receive information from the host environment and process user prompt data during execution. In the PyPI package, the Go based binary was triggered when the affected module was imported into an application.
The primary objective of the malware was to collect sensitive information from developer systems, cloud platforms, source code services, package repositories, and development tools. Researchers reported that the implant could gather credential files, environment variables containing authentication details, API keys, tokens, session information, and other sensitive configuration data. Potentially targeted credentials included access details related to npm, PyPI, GitHub, GitLab, AWS, HashiCorp Vault, SSH keys, and other developer services. Security researchers also identified references to credentials associated with platforms such as Hugging Face, Slack, Stripe, SendGrid, and other technology services. The collected information was reportedly sent to an external server identified as “skyleen[.]fr”. Security analysts warned that developer environments often contain access credentials used for cloud services, source repositories, and automated workflows, making them valuable targets in supply chain incidents.
SafeDep’s investigation found that the attacker obtained publishing tokens from MemTensor’s GitHub Actions release pipelines by introducing changes that caused the workflows to expose npm or PyPI publishing credentials. Further analysis suggested that the sckit implant could potentially operate with worm like characteristics by attempting to spread through GitHub workflows and package publishing channels. Researchers said the malware was capable of collecting credentials from developer machines and continuous integration environments while receiving signed instructions from a command and control server. It also contained templates that could support installation into npm packages, Python packages, and GitHub Actions workflows. At the time of reporting, researchers had not confirmed whether packages beyond MemTensor were affected by the compromise.
Security teams and developers using the affected packages have been advised to take precautionary measures, including moving to known safe package versions, rotating potentially exposed credentials, removing suspicious processes, and blocking communication with identified malicious infrastructure. Researchers recommended using npm version 0.1.20 and PyPI version 2.0.33 as safe baselines for the affected packages. StepSecurity highlighted that the compromised MemOS Cloud plugin operates within environments that process user inputs and may have access to valuable credentials, increasing the potential impact of the compromise on both developer workstations and automated environments. The incident reinforces the importance of securing software development pipelines, monitoring third party dependencies, and regularly reviewing package integrity as organizations increasingly rely on open source components in modern applications.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
