Malicious ‘sckit’ Worm Targets MemTensor Packages on npm and PyPI to Harvest Developer Credentials

Unknown threat actors have successfully compromised legitimate MemTensor packages across both the npm and Python Package Index (PyPI) software repositories in a sophisticated supply chain attack. The compromised libraries are being used to distribute a platform-specific, Go-based implant known as sckit, which is engineered to target Windows, Linux, and macOS environments.

According to comprehensive threat intelligence reports released by cybersecurity firms Aikido, SafeDep, Socket, and StepSecurity, the targeted software repositories contain hidden payloads designed to infiltrate developer environments and CI/CD pipelines. Security researchers have warned that the malware functions not just as a standard credential harvester, but also exhibits worm-like self-proliferation capabilities, allowing it to autonomously infect other packages and automated workflows.

The incident highlights growing concerns over the security of software supply chains, particularly regarding AI memory integrations and developer tooling. As modern applications increasingly rely on third-party libraries for specialized functions like memory-recall and agent gateways, malicious actors are finding lucrative entry points by hijacking trusted publication channels.

Anatomy of the MemTensor Supply Chain Attack

The vector of the attack involved injecting malicious code into established MemTensor packages. In the case of the npm ecosystem, threat actors embedded a hidden Go payload directly into legitimate AI memory integration features. Specifically, versions 0.1.21, 0.1.23, and 0.1.25 of the affected npm packages contain unauthorized code that automatically launches the payload as soon as the agent gateway starts up. Furthermore, the payload is triggered repeatedly whenever the plugin handles a memory-recall event during normal operation.

Security analysis from StepSecurity revealed that the malicious launcher is designed to pass the host process environment directly to the executable. During memory-recall operations, the user’s prompt text is also fed straight into the malicious executable, potentially exposing sensitive data processed by the AI agent.

In contrast, the attack vector on the Python Package Index (PyPI) utilized a different execution trigger. The compromised PyPI packages are structured so that they immediately initiate the statically-linked Go binary the moment the "memos" module is imported into an application. Whether executed via a Node.js environment or a Python application, the ultimate objective remains consistent: deploying a cross-platform credential-stealing payload.

Investigators from Socket noted that the malware casts a wide net, targeting sensitive data from a vast array of cloud services, source-code management platforms, package registries, and developer tools. The harvested credentials include sensitive tokens for npm, PyPI, GitHub, GitLab, AWS, HashiCorp Vault, and local SSH secrets. Once gathered, this data is exfiltrated to an external command-and-control server hosted at the domain "skyleen[.]fr".

Compromised Pipelines and Worm-Like Capabilities

How the threat actors managed to breach the MemTensor packages has also come to light through forensic investigations. SafeDep reported that the attackers successfully acquired valid publish tokens directly from MemTensor’s own GitHub Actions release pipelines. By pushing malicious commits into the repository, the attackers manipulated the automated workflow to surrender the necessary npm and PyPI authentication tokens, granting them authorized publishing rights without raising immediate suspicion.

What elevates the severity of the sckit campaign is its capacity for self-propagation. A deeper technical examination of the implant suggests that it operates like a digital worm, capable of spreading itself through GitHub repositories as well as direct automated publishing to npm and PyPI. While investigations are ongoing, security experts are still working to determine whether repositories other than MemTensor have been silently impacted by the same threat actors.

SafeDep’s analysis emphasized that the malware is designed for systemic persistence. It collects credentials not only from local developer workstations but also from automated continuous integration jobs. It receives cryptographically signed tasks from its external command-and-control infrastructure and contains built-in templates allowing it to automatically package and install itself into new npm packages, Python packages, and GitHub Actions workflows.

Mitigation and the Broader Threat to AI Integrations

Security firms have urged developers and security teams to take immediate remedial action. Because malicious versions of the npm and PyPI packages remain accessible in public repositories depending on caching and download states, organizations utilizing MemTensor should immediately pin their dependencies to safe baseline versions. Experts recommend rolling back to version 0.1.20 for the npm package and version 2.0.33 for the PyPI package.

Additionally, organizations must rotate any potentially exposed secrets, cloud keys, and publishing tokens, immediately terminate any running instances of the sckit process, and implement network-level blocks against the C2 domain "skyleen[.]fr" and all associated subdomains.

The attack underscores the unique risks introduced by modern AI infrastructure libraries. The MemOS Cloud plugin, for instance, connects the OpenClaw agent runtime to a memory service, operating in a sensitive architectural layer. Its normal function involves recalling relevant memories before an agent processes a user prompt and appending new memories after a run, while also declaring integration points for other runtime environments like Clawdbot and Moltbot.

This positioning places the plugin deep inside processes that routinely handle unstructured user input and inherit high-privilege credentials. On a typical developer workstation, the user account running such software often possesses sweeping access to cloud infrastructure configurations, source code repositories, package publishing tokens, and enterprise application secrets. In automated CI/CD pipelines, the compromised process may receive powerful credentials injected exclusively for specific deployment jobs, making supply chain compromises of this nature exceptionally dangerous for corporate security.