Compromised MemTensor packages spread sckit credential stealer

Unknown attackers compromised two legitimate MemTensor packages published on npm and the Python Package Index (PyPI), the two main open-source registries for JavaScript and Python code, and used them to distribute a credential-stealing implant, according to reports published on 23 September 2026.

The implant has been dubbed sckit. It is written in Go and shipped in platform-specific builds for Windows, Linux and macOS, meaning developers on all three operating systems were exposed rather than a single platform. The findings were reported by four software supply chain security firms — Aikido, SafeDep, Socket and StepSecurity — and summarised by The Hacker News.

One of the affected libraries is the npm package @memtensor/memos-cloud-openclaw-plugin, with specific versions identified as malicious. A second MemTensor package on PyPI was also compromised. The reporting does not identify the attackers, and no motive or attribution has been established.

This is a supply chain compromise rather than a flaw in MemTensor's own code. In this class of attack, someone gains the ability to publish new versions of a package that other developers already trust, then inserts malicious code into an otherwise normal release. Anyone who installs or updates to the tainted version pulls the payload down automatically as part of a routine build. Because package installers frequently run code during installation, the effect can be immediate and silent.

Credential stealers of this kind are a recurring problem for registries such as npm and PyPI, where a single poisoned release can reach machines that hold cloud tokens, source code and deployment keys. Developer workstations and continuous integration systems are attractive targets precisely because they hold long-lived secrets for other systems.

The risk is sharpened by the way modern development environments work. Packages that plug into AI tooling are often installed into the same environment as the credentials that tooling uses — API keys, cloud provider tokens and session data — so a stealer that lands there can harvest access to far more than the machine it runs on.

The practical response for teams is straightforward. Check build logs and lockfiles for the named package and version, since lockfiles record exactly what was installed and when. If a compromised version was pulled in, treat any credential that was present on that machine or in that pipeline as exposed and rotate it, rather than relying on removing the package alone. Registry takedowns stop further installs but do nothing about secrets already taken.

The incident is currently at the reporting stage. The four firms involved have published their findings, but there is no public statement from MemTensor in the available reporting, and no figures have been released for how many downloads the compromised versions received before they were flagged. Further detail on the scope of the compromise, including how the attackers obtained publishing rights, has not been disclosed.