Compromised MemTensor npm and PyPI Packages Deliver sckit Credential Stealer — Detection and Remediation Guide

Unknown threat actors have compromised two legitimate MemTensor packages — one on npm and one on the Python Package Index (PyPI) — and used them to distribute a platform-specific, Go-based credential-stealing implant tracked as sckit. The malicious payloads target Windows, Linux, and macOS, meaning no developer workstation or CI/CD runner in your environment is outside the blast radius.

This is not a theoretical supply chain risk exercise. Researchers at Aikido, SafeDep, Socket, and StepSecurity independently confirmed the compromise, including the poisoned package @memtensor/memos-cloud-openclaw-plugin on npm and its PyPI counterpart. Any developer who installed or updated these packages during the compromise window executed attacker-controlled code with their own privileges — which, on a developer machine, typically means access to cloud credentials, SSH keys, browser credential stores, and source code.

Supply chain intrusions through package registries remain one of the highest-leverage attack paths we've seen in our incident response practice over the past three years. A single poisoned dependency bypasses perimeter controls entirely: the victim pulls the malware through their own trusted tooling, over TLS, from a "reputable" registry. If your organization builds JavaScript or Python software — and it does — treat this as an active incident until proven otherwise.

Technical Analysis

Affected Packages and Platforms

• npm: @memtensor/memos-cloud-openclaw-plugin — malicious versions published by the threat actor following account or publishing-token compromise
• PyPI: The corresponding MemTensor Python package (check your installed memtensor-related distributions against the affected version list published by Aikido, SafeDep, Socket, and StepSecurity)
• Implant: sckit, a Go-compiled credential stealer with platform-specific builds for Windows, Linux, and macOS

No CVE has been assigned to this campaign — this is a malicious-package compromise, not a software vulnerability in the traditional sense. The attack technique maps cleanly to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1555 (Credentials from Password Stores).

Attack Chain

From a defender's perspective, the attack chain breaks down as follows:

1. Package takeover. The threat actors gained control of publishing credentials for the legitimate MemTensor packages. Because the packages are legitimate and previously trustworthy, version updates carrying the malicious code would not trip typical review processes.
2. Malicious lifecycle execution. On npm, the weaponized versions execute during the install phase — almost certainly via preinstall / install / postinstall scripts in package.json. On PyPI, execution occurs through install-time code in setup.py, a malicious __init__.py, or wheel build hooks. This means the victim is compromised the moment npm install or pip install runs — including inside automated CI/CD pipelines with no human interaction.
3. Payload staging. The install-time code downloads or drops the platform-appropriate sckit binary — a statically compiled Go implant. Go's cross-compilation makes it trivial for the actor to ship Windows, Linux, and macOS variants from one codebase, which is exactly what we observed.
4. Credential theft and exfiltration. As a credential stealer, sckit targets the high-value secrets that live on developer machines: browser credential stores (Chrome/Chromium Login Data, Firefox logins), SSH private keys (~/.ssh/id_*), cloud provider credentials (~/.aws/credentials, ~/.azure/, ~/.config/gcloud/), environment files (.env), npm/PyPI tokens (~/.npmrc, ~/.pypirc), and Git credentials. This is the critical second-order risk: a stolen npm or PyPI token is precisely how this actor compromised the MemTensor packages in the first place. Stolen registry tokens turn a single infected workstation into a wormable publishing capability.

Exploitation Status

This is confirmed active, in-the-wild compromise — not a proof of concept. Multiple independent security research firms (Aikido, SafeDep, Socket, StepSecurity) flagged the malicious packages. The malicious versions have been or are being pulled from the registries, but removal from the registry does not remediate machines that already installed the poisoned versions. Any developer workstation, build agent, container base image, or production deployment that pulled an affected version must be treated as compromised.

Why This Matters Beyond the Initial Infection

The most dangerous property of credential stealers targeting developers is downstream amplification. A stolen .npmrc token or cloud access key can be used weeks later to poison additional packages, pivot into cloud infrastructure, or access private source repositories. When we run IR engagements on these incidents, the initial package install is rarely the end of the story — it's the reconnaissance phase.

Detection & Response

The detection strategy below targets the observable behaviors of this campaign: package managers spawning unexpected child processes and binaries at install time, and unauthorized access to credential store locations by non-browser processes.

Sigma Rules

These rules are tuned against the specific behaviors of install-time package malware. Expect some tuning in environments where build tooling legitimately executes scripts during dependency installation — scope exclusions to known-good build agents where possible, but investigate every hit.

---
title: Package Manager Spawning Script Interpreter or Binary During Install
description: Detects npm, pip, or yarn spawning shell interpreters or executables, consistent with malicious install-time scripts in compromised packages such as the MemTensor npm/PyPI compromise delivering sckit.
references:
  - https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html
  - https://attack.mitre.org/techniques/T1195/001/
author: Security Arsenal
date: 2026/09/25
status: experimental
tags:
  - attack.execution
  - attack.t1195.001
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\
ode.exe'
      - '\
pm.cmd'
      - '\
pm.exe'
      - '\\yarn.cmd'
      - '\\yarn.exe'
      - '\\pnpm.exe'
      - '\\python.exe'
      - '\\pip.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\curl.exe'
      - '\\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate packages with native build steps (node-gyp) spawning compilers or shell commands
  - Internal tooling installed via npm/pip with postinstall scripts
level: high
---
title: Non-Browser Process Accessing Browser Credential Stores
description: Detects processes other than the browser itself reading Chrome/Chromium or Firefox credential databases, a core behavior of credential stealers such as the Go-based sckit implant.
references:
  - https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/09/25
status: experimental
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\\Google\\Chrome\\User Data\'
      - '\\Microsoft\\Edge\\User Data\'
      - '\\BraveSoftware\\Brave-Browser\\User Data\'
      - '\\Mozilla\\Firefox\\Profiles\'
  selection_file:
    TargetFilename|endswith:
      - '\\Login Data'
      - '\\Cookies'
      - '\\Web Data'
      - '\\logins.json'
      - '\\key4.db'
      - '\\Local State'
  filter_browsers:
    Image|endswith:
      - '\\chrome.exe'
      - '\\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_path and selection_file and not filter_browsers
falsepositives:
  - Legitimate password managers and enterprise DLP tools auditing browser stores
  - Forensic/EDR tooling performing scheduled scans
level: high
---
title: Suspicious Access to Developer Secret Files on Linux or macOS
description: Detects unexpected process execution referencing SSH private keys, cloud credentials, or registry auth tokens, consistent with the sckit credential stealer harvesting developer secrets after package-based compromise.
references:
  - https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/09/25
status: experimental
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/.ssh/id_rsa'
      - '/.ssh/id_ed25519'
      - '/.aws/credentials'
      - '/.npmrc'
      - '/.pypirc'
      - '/.config/gcloud/'
      - '/.azure/'
  filter_legit:
    Image|endswith:
      - '/ssh'
      - '/ssh-add'
      - '/ssh-agent'
      - '/git'
      - '/aws'
      - '/gcloud'
      - '/az'
  condition: selection and not filter_legit
falsepositives:
  - Backup or secrets-management agents legitimately reading these paths
  - Developer shell aliases that cat credential files (poor practice, but benign)
level: high

KQL Hunt — Microsoft Sentinel / Defender for Endpoint

The following query hunts across Windows endpoints for package-manager-spawned execution followed by access to credential artifacts. Run it across at least the last 30 days — supply chain compromises frequently sit dormant before the implant activates, and the install event may predate public disclosure.

// Hunt for package managers spawning suspicious child processes and credential-store access
// Associated with the MemTensor npm/PyPI supply chain compromise (sckit implant)
let PackageManagers = dynamic([\"node.exe\", \"npm.exe\", \"npm.cmd\", \"yarn.exe\", \"yarn.cmd\", \"pnpm.exe\", \"python.exe\", \"pip.exe\", \"pip3.exe\"]);
let SuspiciousChildren = dynamic([\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"wscript.exe\", \"cscript.exe\", \"curl.exe\", \"certutil.exe\", \"bitsadmin.exe\", \"rundll32.exe\"]);
let CredentialPaths = dynamic([\"\\\Google\\\Chrome\\\User Data\\\", \"\\\Microsoft\\\Edge\\\User Data\\\", \"\\\Mozilla\\\Firefox\\\Profiles\\\", \"\\\.ssh\\\", \"\\\.aws\\\", \".npmrc\", \".pypirc\"]);
let InstallEvents =
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (PackageManagers)
| where FileName in~ (SuspiciousChildren)
| project InstallTime = TimeGenerated, DeviceName, DeviceId, InstallParent = InitiatingProcessFileName, InstallChild = FileName, InstallCmd = ProcessCommandLine, InitiatingProcessCommandLine, ReportId;
let CredAccess =
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any (CredentialPaths)
| where not (InitiatingProcessFileName in~ (\"chrome.exe\", \"msedge.exe\", \"firefox.exe\", \"MsMpEng.exe\", \"svchost.exe\"))
| project CredAccessTime = TimeGenerated, DeviceName, DeviceId, AccessingProcess = InitiatingProcessFileName, AccessingCmd = InitiatingProcessCommandLine, TargetFile = FolderPath;
InstallEvents
| join kind=inner CredAccess on DeviceId
| where CredAccessTime between (InstallTime .. (InstallTime + 6h))
| project DeviceName, InstallTime, InstallParent, InstallChild, InstallCmd, InitiatingProcessCommandLine, CredAccessTime, AccessingProcess, AccessingCmd, TargetFile
| order by InstallTime asc

A device that appears in this join — package manager spawning a shell, followed within six hours by a non-browser process touching credential stores — warrants immediate isolation and a full forensic workup, not just a ticket.

Velociraptor VQL Hunt

Use this artifact to sweep your fleet for the forensic footprint of this campaign: suspicious processes whose command lines reference developer secret locations, plus recently dropped executables in user-writable temp directories (a common staging location for install-time implants like sckit).

-- Hunt for processes referencing developer secret files and staged executables in temp dirs
-- Relevant to MemTensor npm/PyPI supply chain compromise (sckit Go implant)
LET secret_paths = '''(\\.ssh/(id_rsa|id_ed25519)|\\.aws/credentials|\\.npmrc|\\.pypirc|\\.config/gcloud|\\.azure|Login Data|logins\\.json)'''

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ secret_paths
  AND NOT Name =~ '^(ssh|ssh-add|ssh-agent|git|aws|gcloud|az)$'

LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.exe',
  'C:/Windows/Temp/*.exe',
  '/tmp/*',
  '/var/tmp/*',
  '/Users/*/Library/Caches/*'
])
WHERE (Mtime > now() - 30 * 24 * 3600)
  AND Size > 1000000
  AND NOT IsDir

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'STAGED_FILE' AS Name, FullPath AS CommandLine, FullPath AS Exe, NULL AS Username, Mtime AS CreateTime
FROM staged

Note the Size > 1000000 filter on staged files: Go implants like sckit are statically compiled and typically land well above 1 MB, which usefully separates them from small legitimate temp artifacts.

Triage Script — Verify Exposure

Run this Bash script on Linux/macOS developer workstations and build agents to determine whether the malicious MemTensor packages were ever installed and to surface the most common implant staging artifacts. Pair it with registry audit-log review in npm and your artifact proxy.

#!/bin/bash
# MemTensor supply chain compromise exposure check (Linux/macOS)
# Run as the developer user; escalate to root for system-wide sweep
echo \"=== [1] Check npm global and local installs for MemTensor packages ===\"

```bash
npm ls -g 2>/dev/null | grep -i memtensor
find ~ -name \"package.json\" -path \"*/node_modules/@memtensor/*\" 2>/dev/null | head -50
find ~ -maxdepth 6 -type d -name \"@memtensor\" 2>/dev/null | head -20

echo "=== [2] Check pip environments for memtensor distributions ==="

pip list 2>/dev/null | grep -i memtensor

pip3 list 2>/dev/null | grep -i memtensor

find ~ -maxdepth 8 -type d -name \"memtensor*\" -path \"*site-packages*\" 2>/dev/null | head -20

echo "=== [3] Search lockfiles and pip logs for historical evidence (package may have been removed) ==="

grep -ril \"memos-cloud-openclaw-plugin\" ~/projects ~/src ~/dev ~/work 2>/dev/null | head -20
grep -ril \"memtensor\" ~/.npm/_logs/ 2>/dev/null | tail -10

echo "=== [4] Look for suspicious recent executables in staging locations ==="

find /tmp /var/tmp ~/Library/Caches ~/Downloads -maxdepth 2 -type f -size +1M -mtime -30 \\( -perm -111 -o -name \"*.exe\" \\) 2>/dev/null | head -30

echo "=== [5] Check for unexpected outbound connections from node/python processes ===" lsof -i -P -n 2>/dev/null | grep -E "node|python" | grep ESTABLISHED | head -20

echo "=== [6] Audit npm/PyPI token presence (rotate these if any hits in steps 1-3) ===" ls -la ~/.npmrc ~/.pypirc ~/.aws/credentials 2>/dev/null echo "DONE. Any hit in steps 1-4 = isolate the host and open an IR ticket.\