Full Report
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions
Analysis Summary
# Incident Report: Supply Chain Compromise of MemTensor Packages Delivering 'sckit' Implant
## Executive Summary
Unknown threat actors successfully compromised the software supply chain of MemTensor, injecting a cross-platform Go-based implant named `sckit` into legitimate npm and PyPI packages. The malware targets Windows, Linux, and macOS environments to harvest developer credentials, cloud tokens, and environment variables, exfiltrating them to a malicious command-and-control (C2) server. Affected organizations must immediately downgrade to safe package baselines, terminate malicious processes, and rotate all exposed infrastructure secrets.
## Incident Details
- **Discovery Date:** September 23, 2026
- **Incident Date:** Prior to September 23, 2026 (Ongoing at time of reporting)
- **Affected Organization:** MemTensor (and downstream users of affected packages)
- **Sector:** Technology / Artificial Intelligence / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Prior to September 23, 2026
- **Vector:** CI/CD Pipeline Exploitation / Token Theft
- **Details:** Attackers pushed unauthorized commits to MemTensor's GitHub Actions release pipelines. These commits compromised the workflow logic, forcing the pipeline to expose and hand over valid npm and PyPI publishing tokens to the threat actors.
### Lateral Movement
- **Details:** Armed with legitimate publishing tokens, the threat actors uploaded malicious versions of `@memtensor/memos-cloud-openclaw-plugin` to the npm registry and `MemoryOS` to PyPI. The `sckit` implant also contains worm-like templates designed to automatically inject itself into other GitHub Actions workflows and publish compromised packages directly via developer machines.
### Data Exfiltration/Impact
- **Details:** Once installed, the malware captures host process environments, configuration files, and active user prompts. Stolen data—including AWS keys, GitHub/GitLab tokens, SSH keys, and database connection strings—is exfiltrated to the external threat actor server `skyleen[.]fr`.
### Detection & Response
- **Details:** The anomaly was discovered and analyzed by cybersecurity firms Aikido, SafeDep, Socket, and StepSecurity. Following disclosure, PyPI quarantined the affected `MemoryOS` repository, and security teams published remediation guidelines for affected developers.
## Attack Methodology
- **Initial Access:** Supply Chain Compromise via manipulated GitHub Actions workflows to harvest repository deployment secrets.
- **Persistence:** Static linking of the Go binary into Python/NodeJS modules; the malware executes automatically upon module import (PyPI) or during gateway/plugin lifecycle events (npm).
- **Privilege Escalation:** Inherits the execution privileges of the local developer workstation account or the automated CI/CD container process.
- **Defense Evasion:** Intermittent release pattern (npm versions 0.1.22 and 0.1.24 were left clean to blend with legitimate updates); payload execution is masked inside legitimate AI memory integration services.
- **Credential Access:** Automated searching and harvesting of sensitive credential files (`.npmrc`, `.vault-token`, `id_ecdsa`, `credentials.db`) and targeted environment variables (`NPM_TOKEN`, `PYPI_API_TOKEN`, AWS access keys, Slack/Stripe/SendGrid keys).
- **Discovery:** Enumerating environment variables and file paths related to development tools and cloud infrastructure providers.
- **Lateral Movement:** Worm-like replication capabilities utilizing stolen access tokens to publish malicious payloads upstream to GitHub, npm, and PyPI repositories.
- **Collection:** Intercepting user prompt text during live memory-recall events and copying local configuration stores.
- **Exfiltration:** Standard web protocols directing exfiltrated configuration buffers back to `skyleen[.]fr`.
- **Impact:** Complete exposure of organizational deployment keys, cloud resources, and potentially sensitive proprietary user prompts.
## Impact Assessment
- **Financial:** High risk of downstream financial loss due to the theft of Stripe, AWS, and cloud infrastructure keys.
- **Data Breach:** High. Broad compromise of developer environment variables, corporate repository access tokens, and user-submitted AI prompts.
- **Operational:** Developer workflows disrupted; critical requirements to freeze deployments, isolate CI/CD pipelines, and rotate corporate-wide credentials.
- **Reputational:** High impact on the integrity of MemTensor's open-source repositories and trust in downstream AI integrations.
## Indicators of Compromise
### Network Indicators
- `skyleen[.]fr`
- `*.skyleen[.]fr`
### File Indicators
- **Malicious npm Package:** `@memtensor/memos-cloud-openclaw-plugin` (Versions: 0.1.21, 0.1.23, 0.1.25)
- **Malicious PyPI Package:** `MemoryOS` (Version: 2.0.34)
- **Targeted Target Files:** `.npmrc`, `.vault-token`, `id_ecdsa`, `credentials.db`, `access_tokens.json`, `stored_tokens`
### Behavioral Indicators
- Spawning of unauthorized Go-based background binaries (`sckit`) initiated directly by Node.js or Python runtime processes.
- Sudden, unauthorized outbound traffic from development environments or automated CI runners to `skyleen[.]fr`.
## Response Actions
- **Containment Measures:** PyPI has officially quarantined the `MemoryOS` project to stop further automated downloads.
- **Eradication Steps:** Security teams must scan infrastructure to identify and immediately terminate running `sckit` system processes. Network layer blocks should be placed on `skyleen[.]fr` and its subdomains.
- **Recovery Actions:** Explicitly pin dependencies to known safe baselines (npm: version `0.1.20`; PyPI: version `2.0.33`). Implement an immediate, mandatory rotation of all developer keys, cloud provider secrets, and service tokens.
## Lessons Learned
- **CI/CD Secrets Hardening:** Relying solely on repository-level pipeline secrets without strict branch protection or workflow approval logic allows single-commit access to high-value publishing tokens.
- **Version Spoofing:** Attackers are using sophisticated intermittent versioning tactics (interspersing malicious releases with clean releases) to bypass basic delta-based automated security checks.
## Recommendations
- Implement OpenID Connect (OIDC) trusted publishing for npm and PyPI registries to eliminate long-lived, hardcoded deployment secrets within GitHub Actions.
- Enforce strict dependency pinning (using exact versions and lockfile integrity verification hashes) across all corporate codebases.
- Restrict outbound internet connectivity for automated CI/CD runners using network-level egress filtering.