<![CDATA[Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI]]>Unknown threat actors have compromised two legitimate MemTensor packages across the npm and PyPI repositories, using them to distribute a platform-specific, Go-based implant tracked as sckit. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the affected libraries are the @memtensor/memos-cloud-openclaw-plugin versions on npm and a related package on PyPI.

The sckit implant is designed to operate across Windows, Linux, and macOS, suggesting the campaign targets a broad range of developer environments rather than a single platform.

Key points from the reporting:

  • Two legitimate MemTensor packages were compromised, one on npm and one on PyPI
  • The affected npm package is @memtensor/memos-cloud-openclaw-plugin
  • The payload is a Go-based implant named sckit
  • sckit supports Windows, Linux, and macOS
  • The activity was documented by Aikido, SafeDep, Socket, and StepSecurity

If you maintain projects that depend on these packages, review your lockfiles and dependency trees for any usage, and check build and CI environments for signs of unexpected outbound activity.

Source: The Hacker News

Have you audited your dependency manifests for these compromised MemTensor packages yet?

]]>https://xploitlk.com/topic/484/compromised-memtensor-packages-deliver-sckit-credential-stealer-via-npm-and-pypiRSS for NodeTue, 27 Oct 2026 08:22:46 GMTSun, 27 Sep 2026 12:30:25 GMT60