Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Reported by The Hacker News (info@thehackernews.com (The Hacker News))

Summary by Cyber Security News23 Sep 2026, 15:52 CEST

About this summary. This is a short, independently written summary of an article first published by The Hacker News. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and StepSecurity, the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 3

Update Chrome: 108 security fixes for desktop, new release for Android

Google Chrome security advisory (AV26-955)

Chrome Beta for Desktop Update

Chrome for Android Update