Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
-
Unknown threat actors have compromised two legitimate MemTensor packages across the npm and PyPI repositories, using them to distribute a platform-specific, Go-based implant tracked as sckit. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the affected libraries are the @memtensor/memos-cloud-openclaw-plugin versions on npm and a related package on PyPI.
The sckit implant is designed to operate across Windows, Linux, and macOS, suggesting the campaign targets a broad range of developer environments rather than a single platform.
Key points from the reporting:
- Two legitimate MemTensor packages were compromised, one on npm and one on PyPI
- The affected npm package is @memtensor/memos-cloud-openclaw-plugin
- The payload is a Go-based implant named sckit
- sckit supports Windows, Linux, and macOS
- The activity was documented by Aikido, SafeDep, Socket, and StepSecurity
If you maintain projects that depend on these packages, review your lockfiles and dependency trees for any usage, and check build and CI environments for signs of unexpected outbound activity.
Source: The Hacker News
Have you audited your dependency manifests for these compromised MemTensor packages yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login