Malicious MemTensor MemOS packages on npm and PyPI planted Go malware that steals cloud, GitHub, and AI secrets

Attackers published tainted MemTensor MemOS packages on npm and PyPI that can steal developer, cloud, and AI-service credentials. The malicious packages include a previously unseen Go implant called sckit and affected MemOS components, including a memory plugin for the OpenClaw AI agent harness. The malware activates when the package is imported or used, not just at install time, and looks for secrets tied to npm, PyPI, GitHub, AWS, and Hugging Face; researchers say it also contains templates for worm-like spread through npm, PyPI, and GitHub Actions.