Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors compromised two legitimate MemTensor packages on npm and PyPI to deliver a Go-based implant called sckit targeting Windows, Linux, and macOS. The malicious libraries, including @memtensor/memos-cloud-openclaw-plugin, were flagged by Aikido, SafeDep, Socket, and StepSecurity. Users who installed the packages may have had credentials stolen.