Sckit

The malware appears to publish to npm via npm publish and npm version patch and to PyPI via twine upload using credentials stolen from infected workstations or CI environments.

The attacker obtained the publish tokens from MemTensor's own GitHub Actions release pipelines by pushing commits that caused the workflow to hand over the npm or PyPI token. | Unknown threat actors compromised legitimate MemTensor packages across npm and PyPI, inserting a hidden Go payload into otherwise legitimate package releases.

The malware contains JavaScript and Python stubs intended to execute the malware from other infected repositories.

The malicious npm versions ... import launchStageZero from a new file, lib/sckit.js, and invoke it from the plugin's existing registration and recall logic.

It contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows, and can function like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing.

Otherwise, it attempts to spawn that binary with stage0 --config64 and an embedded base64 configuration. The child uses detached: true and stdio: "ignore".

The malicious npm versions contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event. The PyPI package starts the statically-linked Go binary as soon as the 'memos' module is imported.

The malware appears to publish to npm via npm publish and npm version patch and to PyPI via twine upload using credentials stolen from infected workstations or CI environments.

The malware contains a GitHub action template to automatically trigger itself on any push to a compromised repository.

The malware appears to publish to npm via npm publish and npm version patch and to PyPI via twine upload using credentials stolen from infected workstations or CI environments.

The malware contains a GitHub action template to automatically trigger itself on any push to a compromised repository.

Otherwise, it attempts to spawn that binary with stage0 --config64 and an embedded base64 configuration. The package analysis ... decoded a configuration that sets inventory_roots to ["$HOME"].

The malware appears to publish to npm via npm publish and npm version patch and to PyPI via twine upload using credentials stolen from infected workstations or CI environments.

Both droppers serve to execute a platform-specific sckit binary from a hidden .sckit directory in the package.

The malware references environment variables related to package publishing credentials and contains a Go regular expression to search for Generic JWTs, AWS access key IDs, GitHub tokens, GitLab tokens, npm access tokens, PyPI API tokens, and other secrets.

The payload harvests credential files including .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json, and stored_tokens.

The recovered matching expressions include names associated with passwords, private keys, API keys, session cookies, and database or message-broker connection strings.

Targets include AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid keys, and JWTs.

It harvests environment variables that indicate tokens, passwords, API keys, private keys, session cookies, and database or message-broker connection strings, such as NPM_TOKEN and PYPI_API_TOKEN.

It contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows, and can function like a worm by self-proliferating through GitHub and direct npm and PyPI package publishing.

A configuration embedded in the JavaScript launcher names three external endpoints and sets the user's home directory as the collection root.

The implant receives signed tasks from a command-and-control (C2) server and exfiltrates collected details to an external server, skyleen[.]fr.

The credential-stealing payload harvests sensitive data and exfiltrates the details to an external server (skyleen[.]fr).