{"id":1953,"date":"2026-09-24T12:44:50","date_gmt":"2026-09-24T07:14:50","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1953"},"modified":"2026-09-28T11:48:04","modified_gmt":"2026-09-28T06:18:04","slug":"ai-memory-packages-become-credential-stealing-supply-chain-implants","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/ai-memory-packages-become-credential-stealing-supply-chain-implants\/","title":{"rendered":"AI Memory Packages Become Credential-Stealing Supply-Chain Implants"},"content":{"rendered":"

The MemTensor compromise turned legitimate AI memory packages into a credential-theft channel. Malicious releases on npm and PyPI delivered sckit, a Go-based stealer targeting Windows, Linux, and macOS. For security administrators, the exposure spans developer workstations, agent gateways, and automation environments.<\/p>\n

These integrations can run with access to prompts, repositories, and credentials. That makes package execution an enterprise security concern, particularly when developers reuse privileged accounts across tools.<\/p>\n

How the MemTensor compromise reaches developer environments<\/h2>\n

Researchers identified malicious releases of two packages:<\/p>\n\n\n\n\n\n\n
Package<\/th>\nAffected versions<\/th>\nAdditional findings<\/th>\n<\/tr>\n<\/thead>\n
@memtensor\/memos-cloud-openclaw-plugin<\/code> on npm<\/td>\n0.1.21, 0.1.23, 0.1.25<\/td>\nResearchers reported 0.1.22 and 0.1.24 clean.<\/td>\n<\/tr>\n
MemoryOS<\/code> on PyPI<\/td>\n2.0.34<\/td>\nPyPI quarantined the project.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The September 23 reporting identifies the affected releases and quarantine status. Teams should check resolved dependency versions rather than assuming every release within the same range is malicious.<\/p>\n

The npm plugin launches its hidden payload when the agent gateway starts and during memory-recall events, passing the user\u2019s prompt and environment data to the executable. Meanwhile, the Python package triggers execution when the application configures logging via memos.log.configure_logging().<\/code><\/p>\n

\n
\n
\n
\n \"cybersecurity-kit\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Cybersecurity kit\n <\/h4>\n

\n Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.\n <\/p>\n \n Download the Resource Kit\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

What the MemTensor compromise exposes<\/h2>\n

The stealer targets credential files and environment variables containing cloud keys, registry tokens, and other secrets. Targets include AWS credentials, GitHub and GitLab tokens, npm and PyPI publishing tokens, Vault tokens, SSH keys, Hugging Face tokens, and JSON Web Tokens (JWTs). Researchers identified skyleen[.]fr as exfiltration infrastructure.<\/p>\n

SafeDep traced publishing-token theft to MemTensor\u2019s GitHub Actions release pipelines. Its analysis also found templates for spreading through npm packages, Python packages, and GitHub Actions workflows. These findings indicate propagation capability; they do not establish the full extent of infections beyond MemTensor.<\/p>\n

For enterprises, this creates a second exposure path: stolen publishing credentials could put downstream consumers at risk.<\/p>\n

What security teams should do now<\/h2>\n

Start with package exposure, then expand the investigation to every identity available during execution.<\/p>\n

    \n
  1. Locate affected installations.<\/strong> Review lockfiles, build records, developer environments, agent gateways, and CI images. Record package versions, execution times, and responsible owners.<\/li>\n
  2. Contain suspicious execution.<\/strong> Investigate sckit processes and connections to the reported domain. Preserve process details, relevant logs, and payload hashes before cleanup.<\/li>\n
  3. Revoke and rotate exposed secrets.<\/strong> Include credentials injected into jobs and secrets accessible through local files. Perform rotation from a trusted environment.<\/li>\n
  4. Restore a verified dependency baseline.<\/strong> Remove malicious releases and rebuild affected environments from trusted inputs. Check caches and reusable images before restarting jobs.<\/li>\n
  5. Audit downstream activity.<\/strong> Review repository changes, workflow modifications, package publications, and cloud activity associated with exposed identities.<\/li>\n<\/ol>\n

    Treat these as coordinated response steps. A dependency rollback alone cannot revoke a stolen token or undo unauthorized publications. Assign endpoint, cloud, and development owners to the same investigation so cleanup and credential recovery proceed together.<\/p>\n

    How Hexnode supports endpoint investigation and containment<\/h2>\n

    Hexnode can support the endpoint portion of this response on supported, enrolled devices.<\/p>\n

    Hexnode UEM<\/a> compliance policies help administrators assess devices against configured requirements and identify posture gaps for follow-up. Compliance status should inform endpoint hygiene decisions; it does not certify that an npm or Python dependency is safe.<\/p>\n

    While sckit targets Windows, macOS, and Linux, Hexnode XDR<\/a>\u2019s Visual Process Tree and one-click remediation actions operate on Windows and macOS endpoints. Administrators can investigate process relationships and initiate Isolate Device, Kill Process \/ Kill Process Tree, and Quarantine File actions. Linux endpoints are managed through Hexnode UEM policy actions.<\/p>\n\n\n\n\n\n\n\n
    Response objective<\/th>\nHexnode XDR action<\/th>\n<\/tr>\n<\/thead>\n
    Restrict an affected endpoint\u2019s connectivity<\/td>\nIsolate Device cuts network access while maintaining the endpoint\u2019s connection to the Hexnode console for ongoing forensic investigation.<\/td>\n<\/tr>\n
    Stop malicious processes<\/td>\nKill Process \/ Kill Process Tree terminates a selected process or its process tree, respectively.<\/td>\n<\/tr>\n
    Contain a malicious payload<\/td>\nQuarantine File blocks and encrypts the file for review.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    These administrator-initiated actions support containment. Credential revocation, package verification, and CI recovery still require coordination with the teams operating those systems.<\/p>\n

    FAQs<\/h2>
    How can organizations tell whether they installed a malicious MemTensor package?<\/span>\n
    <\/span><\/span><\/div>\n <\/div>

    Teams should check resolved dependency versions in lockfiles, build records, developer environments, agent gateways and CI images. The reported malicious releases include @memtensor\/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25, plus MemoryOS version 2.0.34.<\/p>\n<\/div><\/div><\/div>

    What credentials can the sckit malware steal?<\/span>\n
    <\/span><\/span><\/div>\n <\/div>

    sckit targets credential files and environment variables containing secrets such as AWS credentials, GitHub and GitLab tokens, npm and PyPI publishing tokens, Vault tokens and SSH keys. Security teams should assess which credentials were accessible wherever an affected package executed.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n

    Protect the secrets behind AI integrations<\/h3>\n

    AI integrations inherit software supply-chain risks while introducing access to agent context and prompts. Reduce that exposure through reviewed dependencies, limited credential access, and monitored execution. When compromise occurs, contain affected endpoints and revoke exposed credentials together.<\/p>\n

    <\/div><\/div>
    Strengthen Software Supply Chain Defense<\/h5>

    Protect developer endpoints, detect credential theft, and contain supply-chain threats faster with Hexnode UEM and XDR.<\/p>