Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS.
According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below –
The malicious npm package versions include a “hidden Go payload into a legitimate AI memory integration. Versions 0.1.21, 0.1.23, and 0.1.25 contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event,” StepSecurity said.
“The launcher passes the host process environment and, during recall, the user’s prompt text directly to the malicious executable.”
The PyPI package, on the other hand, starts the statically-linked Go binary as soon as the “memos” module is imported into an application.
Regardless of the ecosystem targeted, the end goal is to launch a cross-platform credential-stealing payload capable of harvesting sensitive data from cloud services, source-code platforms, package registries, and developer tools and exfiltrating the details to an external server (“skyleen[.]fr”).
According to Socket, targets include npm, PyPI, GitHub, GitLab, AWS, Vault and SSH secrets –
- Credential files (.npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens)
- Environment variables that indicate tokens, passwords, API keys, private keys, session cookies and database or message-broker connection strings (e.g., NPM_TOKEN and PYPI_API_TOKEN)
- AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid keys, and JWTs
SafeDep, in its analysis of the supply chain attack, said the attacker obtained the publish tokens from MemTensor’s own GitHub Actions release pipelines by pushing commits that caused the workflow to hand over the npm or PyPI token.
A deeper examination of the implant suggests that it can function like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing. As of writing, it’s unclear if there are packages other than MemTensor that are impacted by the compromise.
“It collects credentials from developer machines and from CI jobs,” SafeDep said. “It receives signed tasks from a command-and-control (C2) server. It also contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows.”
Given that the malicious versions of the npm packages are still available for download, it’s essential to pin the packages to a safe baseline version (0.1.20 for the npm package, 2.0.33 for the PyPI package), rotate exposed secrets, kill any sckit process, and block “skyleen[.]fr” and all its subdomains.
“The MemOS Cloud plugin connects the OpenClaw agent runtime to a memory service,” StepSecurity said. “Its normal work includes recalling relevant memories before an agent processes a prompt and adding memories after a run. The package also declares integration points for the Clawdbot and Moltbot runtimes.”
“This places the plugin inside a process that routinely handles user input and may inherit valuable credentials. On a developer workstation, the same user account can have access to cloud configuration, source repositories, package publishing tokens, and application secrets. In automation, the process may receive credentials injected for a particular job.”
