Unknown threat actors have successfully infiltrated the software supply chain by injecting a malicious implant into widely used package repositories. The attack targeted **MemTensor**, an AI memory integration library, leading to the distribution of a credential-stealing payload. ### Compromised Packages and 'sckit' Implant The compromised libraries include specific versions of **@memtensor/memos-cloud-openclaw-plugin** on npm and **MemoryOS** on PyPI. Reports from **Aikido**, **SafeDep**, **Socket**, and **StepSecurity** detail how the attackers embedded a platform-specific Go-based implant, named **sckit**, into these packages. * **@memtensor/memos-cloud-openclaw-plugin**: Versions 0.1.21, 0.1.23, and 0.1.25 were found to contain the malicious payload. (Versions 0.1.22 and 0.1.24 are clean). * **MemoryOS**: Version 2.0.34 was compromised. The project has since been quarantined on PyPI.  ### How the Implant Operates For the npm package, the malicious Go payload is launched when the agent gateway starts or when the plugin handles a memory-recall event. This allows the implant to access the host process environment and even user prompt text. In the PyPI package, the statically-linked Go binary executes as soon as the "memos" module is imported into an application. The primary objective of **sckit** is to harvest sensitive data. This includes credentials from cloud services, source-code platforms, package registries, and developer tools. The stolen information is then exfiltrated to an external server located at "skyleen[.]fr". ### Targeted Credentials **Socket**'s analysis revealed a broad range of targeted credentials, including: * Credential files such as `.npmrc`, `.vault-token`, `id_ecdsa`, `credentials.db`, `access_tokens.json`, and `stored_tokens`. * Environment variables containing tokens, passwords, API keys, private keys, session cookies, and database/message-broker connection strings (e.g., `NPM_TOKEN`, `PYPI_API_TOKEN`). * **AWS** access keys, **GitHub** and **GitLab** tokens, npm and PyPI tokens, **Hugging Face**, **HashiCorp Vault**, **Slack**, **Stripe**, **SendGrid** keys, and **JWTs**. ### Attack Vector and Proliferation **SafeDep**'s investigation suggests the attackers gained initial access by compromising **MemTensor**'s **GitHub Actions** release pipelines. They achieved this by pushing commits designed to trick the workflow into revealing npm or PyPI publish tokens.  Further analysis of the implant indicates it possesses worm-like capabilities, allowing it to self-propagate through **GitHub** and direct npm/PyPI package publishing. **SafeDep** noted that **sckit** "collects credentials from developer machines and from CI jobs," receives signed tasks from a command-and-control (C2) server, and contains templates to install itself in npm packages, Python packages, and **GitHub Actions** workflows. ### Mitigation and Update Initially, the malicious versions of the npm packages remained available. Users were advised to pin packages to safe baseline versions (0.1.20 for the npm package, 2.0.33 for the PyPI package), rotate all exposed secrets, terminate any running **sckit** processes, and block the domain "skyleen[.]fr" and its subdomains. **Update:** The malicious versions have since been removed from both npm and PyPI. The latest clean versions are **@memtensor/memos-cloud-openclaw-plugin** version 0.1.24 and **MemoryOS** version 2.0.33.