Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors compromised two legitimate MemTensor packages hosted on npm and PyPI to distribute a Go-based implant called sckit. The malware is designed to steal credentials and targets Windows, Linux, and macOS platforms. The compromised package identified includes @memtensor/memos-cloud-openclaw-plugin. Multiple security firms including Aikido, SafeDep, Socket, and StepSecurity reported on the campaign. This represents a supply chain attack leveraging trusted open-source repositories. The implant is platform-specific and cross-platform in scope, broadening its potential victim pool. The use of legitimate package namespaces increases the likelihood of developer trust and accidental installation.