Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
A supply chain attack has compromised legitimate MemTensor packages on npm and PyPI to distribute a Go-based credential stealer named 'sckit'. The malicious packages target Windows, Linux, and macOS, stealing credentials from cloud services (AWS, GCP), source code platforms (GitHub, GitLab), package registries, and developer tools. The attacker gained publish tokens by exploiting MemTensor's GitHub Actions pipelines. The implant exfiltrates data to an external server and can self-propagate through GitHub and package publishing.
- Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer.
- The malware, dubbed 'sckit', harvests secrets from cloud services, source code platforms, and developer tools.
- The attack leverages supply chain compromise, including theft of publish tokens from GitHub Actions.
- The implant can self-proliferate through GitHub and package registries, acting like a worm.
- Compromised versions are @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and MemoryOS (2.0.34).
- ATT&CK
- T1195 Supply Chain CompromiseT1555 Credentials from Password StoresT1003 OS Credential DumpingT1041 Exfiltration Over C2 Channel
- Malware
- sckit
- Victims
- MemTensorDevelopers
- Organizations
- AikidoSafeDepSocketStepSecurityMemTensor
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | skyleen.fr | tools and exfiltrating the details to an external server ("skyleen[.]fr"). According to Socket, targets include npm, PyPI, GitHub |
From the original article
2 min read at thehackernews.com
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.