Infected npm versions include 0.1.21, 0.1.23, and 0.1.25, while versions 0.1.22 and 0.1.24 are clean. The sckit malware activates as soon as the PyPI module is imported or upon trigger in the npm plugin, leading security researchers to advise users to pin exact dependency versions to mitigate this supply-chain compromise.
Tuesday, October 20, 2026
Story
4 MemTensor Releases Contain Go Credential Stealer
Cybersecurity27 days ago
Developer and cloud secrets are at risk after hackers embedded the sckit malware within the software distribution channels of MemTensor. Four malicious releases on the npm and PyPI registries deploy cross-platform Go binaries to steal credentials for AWS, GitHub, and SSH, while the memos-cloud plugin for OpenClaw is specifically designed to capture user prompt text during memory-recall events.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.