MemTensor Supply Chain Attack Deploys Cross-Platform sckit Stealer

Introduction

A coordinated supply chain attack has compromised legitimate MemTensor packages across two major package repositories, npm and the Python Package Index (PyPI), deploying a sophisticated cross-platform credential stealer named sckit. The malicious implants, written in Go, target Windows, Linux, and macOS systems with equal effectiveness. This incident underscores the growing threat of repository-level compromises where trusted packages become unwitting delivery vehicles for advanced malware.

Research teams from Aikido, SafeDep, Socket, and StepSecurity independently identified the campaign, which centers on the @memtensor/memos-cloud-openclaw-plugin package family. The attackers demonstrated deep understanding of package management ecosystems, embedding platform-specific payloads that activate based on the victim's operating system. This level of cross-platform engineering represents a significant escalation in supply chain attack sophistication.

Anatomy of a Dual-Repository Compromise

The attack's most striking characteristic is its simultaneous presence across both JavaScript and Python ecosystems. Rather than targeting a single language community, the threat actors compromised packages in both npm and PyPI, maximizing potential victim reach. This dual-repository strategy suggests either a single well-resourced actor or coordinated collaboration between groups specializing in different ecosystems.

The compromised package, @memtensor/memos-cloud-openclaw-plugin, appears to be a legitimate MemTensor component that was either hijacked through credential theft, maintainer account compromise, or a malicious contribution accepted during review. The malicious versions contain obfuscated Go binaries that deploy sckit, a credential harvester capable of extracting browser-stored passwords, session tokens, API keys, and cryptocurrency wallet credentials.

sckit: Engineering a Universal Credential Harvester

The sckit implant represents substantial development investment. Written in Go, it compiles to native binaries for all three major desktop platforms, eliminating dependency on interpreters or runtime environments. This design choice provides several attacker advantages: smaller footprint, faster execution, harder static analysis, and consistent behavior across platforms.

• Windows variant: Targets Chromium-based browsers (Chrome, Edge, Brave), Firefox, and Windows Credential Manager
• Linux variant: Extracts from Chrome/Chromium, Firefox, and common secret storage backends like libsecret
• macOS variant: Accesses Keychain, Safari, Chrome, and Firefox credential stores

Each variant implements platform-appropriate evasion techniques, including anti-debugging checks, sandbox detection, and living-off-the-land binary execution to minimize suspicious process creation.

Detection and Attribution Challenges

The coordinated disclosure by four independent security firms highlights both the attack's visibility and the difficulty of attribution. Aikido, SafeDep, Socket, and StepSecurity each brought different telemetry sources — static analysis, runtime behavioral monitoring, dependency graph analysis, and CI/CD pipeline scanning respectively. Their convergence on the same campaign validates the findings but also reveals how fragmented the current detection landscape remains.

No threat actor has claimed responsibility, and code similarities to known groups remain inconclusive. The Go implementation, cross-platform targeting, and supply chain vector align with several advanced persistent threat profiles, but false flag operations cannot be ruled out. The choice of MemTensor — a machine learning tensor library — as the compromise target may indicate interest in AI/ML development environments specifically.

Impact Radius and Developer Risk

Any project that incorporated the compromised MemTensor package versions during the exposure window faces potential credential theft. The risk extends beyond direct dependencies; transitive dependencies in larger dependency trees may have pulled the malicious versions indirectly. Organizations using automated dependency updates without pinning or verification are particularly exposed.

Developers who installed compromised versions should assume all credentials accessible from their development machines during the installation period are compromised. This includes cloud provider tokens, GitHub personal access tokens, database connection strings, and any secrets stored in browser password managers or system credential stores.

Conclusion

The MemTensor compromise serves as a stark reminder that no package repository is immune to infiltration, and cross-platform malware development has lowered the barrier for universal credential theft. Security teams must move beyond repository trust models toward continuous verification of dependency behavior. Immediate actions include auditing all MemTensor package usage, rotating potentially exposed credentials, and implementing install-time behavioral analysis for third-party dependencies. Grivyonx Cloud's AI automation platform provides real-time supply chain threat detection and automated response workflows that help organizations identify and contain such compromises before credential exfiltration occurs.