MemTensor npm and PyPI Packages Deliver sckit Worm That Steals Every Developer Credential

The attacker gained access to MemTensor's GitHub account, likely through a previously stolen token, and used it to push short-lived branches to the MemTensor repository between 00:48 and 02:03 UTC on September 23. These branches contained modifications to the repository's npm and PyPI release workflows.

For the npm package, the attacker modified a validation script to inject a path into the BASH_ENV environment variable pointing to a malicious shell script. GitHub Actions processes BASH_ENV before each step in a workflow, causing the injected shell script to execute before the actual npm publish step. The malicious script captured the NPM_TOKEN from the workflow environment and delivered it to the attacker's C2 before any legitimate package publication occurred.

For the PyPI package, the attacker replaced the Poetry build backend used in the release workflow with a custom backend that performed an identical BASH_ENV injection, this time capturing the PYPI_API_TOKEN. In both cases, the legitimate publish job failed silently after the token was stolen, but the attacker then used the captured credentials to publish the backdoored versions directly.

The malicious npm versions (0.1.21, 0.1.23, 0.1.25) and the malicious PyPI version (2.0.34) each carry a sckit binary compiled for Windows, Linux, and macOS, in both AMD64 and ARM64 variants. The binary does not rely on any postinstall hook. It activates when the package is first imported during application startup or a memory-recall operation, runs silently in the background, and immediately begins harvesting credentials.

The clean versions remain npm 0.1.20, 0.1.22, and 0.1.24 (with 0.1.20 being the recommended safe pin), and PyPI 2.0.33. Anyone relying on npm install or pip install without version pinning received the backdoored version by default during the compromise window.

sckit targets 13 distinct credential categories from developer home directories and CI/CD environment variables. The full list includes: npm publish tokens, PyPI API tokens, GitHub personal access tokens, GitLab access tokens, SSH private keys, AWS CLI credentials, GCP service account keys, Azure CLI tokens, HashiCorp Vault tokens, Hugging Face API tokens, Slack tokens, Stripe API keys, and SendGrid API keys. On CI/CD runners, sckit also captures any secrets injected into the workflow environment as environment variables, including database connection strings and container registry credentials.

The affected packages are part of the MemOS ecosystem, an AI memory framework used by LLM agent developers to give AI models persistent memory across sessions. Any developer building LLM agents, AI pipelines, or memory-augmented applications who pulled these packages in their development environment, virtual environment, Docker container, or CI/CD pipeline should assume full credential exposure.

CI/CD environments are a priority concern. When sckit runs inside a GitHub Actions runner or other CI system, it captures not just the environment variables of the current job but also any credentials cached in the runner's home directory from previous jobs. If the runner has npm, PyPI, or GitHub publishing access, sckit uses those tokens immediately to propagate itself into additional packages.

The worm also performs host profiling including timezone, system language, and privilege level. It applies geo-based filtering, meaning not every infected machine will receive follow-on tasking. Organizations in certain regions may see sckit harvest credentials without delivering subsequent payloads.

For an in-depth look at how stolen npm registry credentials are weaponized downstream, see the prior coverage of the LiteLLM supply chain attack and Sapphire Sleet's npm supply chain campaign.

The sckit C2 infrastructure is hosted under skyleen.fr. The npm campaign uses three subdomains resolving to 139.84.223.178: 8a8acaf167b3.skyleen.fr, 0b48fafd6fbe.skyleen.fr, and 266297c6df27.skyleen.fr. The PyPI campaign uses three separate subdomains: c747d139e7e9.skyleen.fr, 73376a079d87.skyleen.fr, and d4f77a3a8cb0.skyleen.fr. A seventh subdomain, 10729e014d0e.skyleen.fr, serves as the CI token capture endpoint, receiving POST requests to /eb57efaa7365698fc1e4decc/initial-ci-v2 from infected CI runners.

All C2 communication uses HTTPS with XChaCha20-Poly1305 encryption over a CBOR-encoded binary protocol, making payload inspection difficult without TLS interception. The binary validates downloaded task signatures before executing them, providing attribution resistance and preventing third parties from hijacking compromised machines.

The actor self-identifies as "supplychain.local" within the sckit Go module path. Campaign IDs embedded in the base64-encoded configuration strings are "cloud-openclaw-semi-nuclear" for the npm variant and "memos-semi-nuclear" for the PyPI variant. No external attribution to a named threat actor or nation-state has been made.

The worm carries three propagation template sets. The npm template publishes a new backdoored version to any registry the victim has write access to. The PyPI template does the same for Python packages. The GitHub Actions template injects a runtime-update.yml workflow file into any repository the stolen GitHub token can push to, triggering sckit execution on each subsequent push. This three-vector propagation design means a single compromised developer machine can seed hundreds of downstream packages and CI environments.

The September 19 Brevo supply chain attack via WordPress demonstrates how supply chain footholds from one compromised package vendor can cascade across unrelated infrastructure. sckit is designed to scale the same cascade.

Block skyleen.fr and all subdomains immediately at DNS and egress firewall. The IP 139.84.223.178 currently hosts the npm campaign's C2 subdomains and should also be blocked. Hunt for sckit process execution artifacts and the worm's state directories before completing credential rotation. If either directory exists on a developer machine or CI runner, treat credential rotation as urgent rather than precautionary.

Two detection rules cover the sckit worm's primary behavioral indicators: process execution of the stage0 dropper and DNS resolution of the C2 infrastructure at skyleen.fr. The process creation rule requires endpoint telemetry with command-line argument logging enabled. The DNS query rule requires DNS logging at the resolver or endpoint level. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

Recovery from a MemTensor exposure requires immediate action across four domains: package removal, process termination, credential rotation, and repository audit. Treat this as a confirmed breach until all steps are complete. Do not defer credential rotation, even if your machine showed no obvious signs of compromise: sckit runs silently in the background and suppresses its own output.