Malicious npm and PyPI Packages Deliver Credential-Stealing Malware to Developers

Security researchers have identified a supply chain attack in which threat actors compromised legitimate MemTensor packages published on npm and the Python Package Index (PyPI). The tampered packages secretly install a Go-based implant known as sckit, which runs on Windows, Linux, and macOS. Once active, it launches automatically, either during agent gateway startup and memory-recall events for the npm version, or immediately upon import for the PyPI version.

The implant is designed to steal credentials from developer machines and CI/CD pipelines, targeting platforms such as npm, PyPI, GitHub, GitLab, AWS, Vault, and SSH. Stolen data is sent to an external server. Investigators say the attackers gained access by manipulating MemTensor's GitHub Actions release pipeline to extract publishing tokens, and the malware shows worm-like behaviour, capable of spreading further by publishing itself into other packages and workflows. It is not yet known whether packages beyond MemTensor's have been affected.

Because malicious versions remain downloadable, organisations using these packages should act quickly. Safe versions have been identified (0.1.20 for npm, 2.0.33 for PyPI), and affected users should update immediately, rotate any exposed credentials, terminate running sckit processes, and block network communication to the malicious domain.