Cybersecurity
Compromised packages spread sckit stealer through npm and PyPI
Researchers said attackers altered MemTensor packages on npm and PyPI to spread a Go implant called sckit, which stole credentials and secrets from developer systems and cloud accounts.
- Unknown threat actors were said to have compromised two MemTensor packages across npm and PyPI and used them to distribute a Go implant called sckit.
- The article said the affected npm package versions were 0.1.21, 0.1.23 and 0.1.25, while 0.1.22 and 0.1.24 were clean; it also said MemoryOS 2.0.34 was quarantined on PyPI.
- StepSecurity said the npm package ran the payload when the agent gateway started and when it handled a memory-recall event, while the PyPI package launched its Go binary when the memos module was imported.
- Socket said the implant was built to steal credentials and secrets from services including npm, PyPI, GitHub, GitLab, AWS, Vault and SSH, then send them to skyleen[.]fr.
- SafeDep said the attackers got publish tokens from MemTensor's GitHub Actions release pipelines after pushing commits that caused the workflow to expose an npm or PyPI token.
Unknown attackers were said to have altered two MemTensor packages in the npm and PyPI ecosystems. Researchers said the modified releases installed a Go-based implant named sckit, which was intended for Windows, Linux and macOS.
StepSecurity said the npm package @memtensor/memos-cloud-openclaw-plugin was affected in versions 0.1.21, 0.1.23 and 0.1.25. It said 0.1.22 and 0.1.24 were clean, and that the malicious code ran when the agent gateway started and when a memory-recall event was handled.
For PyPI, the article said MemoryOS 2.0.34 was quarantined. It said the module launched a statically linked Go binary as soon as the memos module was imported into an application.
Socket said the goal was to collect credentials and other secrets from developer tools, source-code services, cloud accounts and package registries, then send them to skyleen[.]fr. SafeDep said the attackers obtained publish tokens from MemTensor's GitHub Actions release pipelines by pushing commits that caused the workflow to expose npm or PyPI tokens, and it said the implant could spread further through GitHub and direct package publishing.
Named in this story
Companies
- MemTensor
- had its package releases and GitHub Actions pipelines compromised
- AWS
- was one of the cloud services whose access keys were targeted
Organisations
- Aikido
- was one of the security firms that reported on the compromise
- SafeDep
- analysed the token theft and possible self-propagation
- Socket
- described the credentials and secrets targeted by the implant
- StepSecurity
- described how the malicious package code ran
Products and systems
- @memtensor/memos-cloud-openclaw-plugin
- was one of the npm packages carrying the malicious code
- MemoryOS
- had version 2.0.34 quarantined on PyPI
- GitHub Actions
- was the release pipeline used to expose publish tokens
- npm
- was one of the package ecosystems affected
- PyPI
- was the other package ecosystem affected
- GitHub
- was one of the services whose tokens were targeted
- GitLab
- was one of the services whose tokens were targeted
- HashiCorp Vault
- was one of the secret stores whose tokens were targeted
How the source tells it
The piece was a technical incident report with a short remediation note.
No emotive framing was found in the original.