Executive Summary
In September 2026, unknown threat actors compromised legitimate MemTensor packages across npm and PyPI repositories, injecting a cross-platform Go-based credential stealer called 'sckit'. The malware targeted @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 on npm, and MemoryOS version 2.0.34 on PyPI. The implant harvested sensitive credentials from cloud services, source-code platforms, package registries, and developer tools, exfiltrating data to skyleen[.]fr. The attackers obtained publish tokens from MemTensor's GitHub Actions pipelines and designed the malware to self-proliferate like a worm through GitHub and direct package publishing.
This incident highlights the growing sophistication of supply chain attacks targeting AI and machine learning ecosystems, where attackers increasingly exploit trusted development pipelines and package repositories to distribute credential-stealing malware at scale.
Why This Matters Now
AI development supply chains are becoming prime targets for sophisticated attackers who exploit the trust developers place in ML packages and the high-value credentials typically present in AI development environments.
Attack Path Analysis
Threat actors compromised MemTensor's GitHub Actions workflows to obtain publishing tokens, then injected malicious Go-based credential stealer 'sckit' into legitimate npm and PyPI packages. The malware harvests developer credentials and cloud tokens from infected environments, exfiltrates data to external C2 infrastructure, and can self-propagate through compromised GitHub repositories and package registries.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers compromised MemTensor's GitHub Actions CI/CD pipelines by pushing malicious commits that caused workflows to expose npm and PyPI publishing tokens
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Valid Accounts
Unsecured Credentials: Credentials In Files
Credentials from Password Stores
Process Injection
Exfiltration Over C2 Channel
Hide Artifacts: Hidden Files and Directories
Container Administration Command
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Supply Chain Security
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT Third-Party Risk Management
Control ID: Article 11
CISA ZTMM 2.0 – Data Categorization and Tagging
Control ID: DA.L2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
ISO 27001:2022 – Information Security Policy for Supplier Relationships
Control ID: A.15.1.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting npm/PyPI packages critically threaten software development workflows, credential theft from CI/CD pipelines, and developer workstation compromise.
Information Technology/IT
Cross-platform credential harvesting from cloud services, package registries, and developer tools exposes IT infrastructure secrets and administrative access credentials.
Financial Services
Stolen API keys, database connections, and session cookies from developer environments could enable unauthorized access to financial systems and sensitive customer data.
Health Care / Life Sciences
Compromised developer credentials threaten HIPAA compliance through potential access to protected health information systems and cloud-based healthcare application infrastructure.
Sources
- Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPIhttps://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.htmlVerified
- Supply Chain Attack Hits MemTensor Packages on npm and PyPI with sckit Wormhttps://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypiVerified
- MemTensor Sckit Worm Compromises npm and PyPI Packageshttps://safedep.io/memtensor-sckit-worm-npm-pypi/Verified
- MemTensor Package Compromise Analysishttps://socket.dev/blog/memtensor-compromiseVerified
- sckit Supply Chain Worm Hits MemTensor npm and PyPI Scopeshttps://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained this supply chain attack by limiting lateral movement between development environments and reducing the blast radius of compromised credentials through segmented network access and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF visibility would likely have detected anomalous workflow execution patterns and unauthorized token exposure within the CI/CD pipeline environment, potentially constraining the scope of credential harvesting activities.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely have limited the reach of compromised publishing tokens by restricting network access from CI/CD environments to external package repositories based on identity and policy verification.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have constrained malware propagation between developer workstations and CI environments by enforcing segmented communication paths and workload isolation policies throughout the development infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely have detected and constrained unauthorized outbound communications to the C2 infrastructure, limiting the malware's ability to receive remote commands and coordinate harvesting activities across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely have constrained unauthorized data transmission to external servers by blocking or limiting outbound connections from compromised workloads, reducing the scope of credential exfiltration activities.
Even with some credential compromise, Zero Trust segmentation would likely have reduced the blast radius of unauthorized access by limiting credential scope and constraining lateral movement across cloud services and development infrastructure.
Impact at a Glance
Affected Business Functions
- Software Development
- CI/CD Pipelines
- Package Management
- Credential Management
Estimated downtime: 3 days
Estimated loss: N/A
Developer credentials including npm tokens, PyPI API tokens, GitHub and GitLab tokens, AWS access keys, SSH private keys, HashiCorp Vault tokens, and various API keys for services like Slack, Stripe, and SendGrid. Environment variables containing passwords, database connection strings, and session cookies were also harvested.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate CI/CD environments and prevent lateral movement between development infrastructure components
- • Deploy Egress Security & Policy Enforcement to block unauthorized outbound connections to domains like skyleen[.]fr and detect credential exfiltration attempts
- • Enable Multicloud Visibility & Control to monitor package installation activities and detect anomalous automation behaviors in development workflows
- • Establish Cloud Native Security Fabric (CNSF) controls to provide real-time inspection of package imports and inline enforcement against malicious payloads
- • Deploy Threat Detection & Anomaly Response capabilities to baseline normal development activities and alert on credential harvesting behaviors or unusual package execution patterns
