Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Software developers and CI/CD environments
Incident: Supply chain compromise of MemTensor libraries delivering the sckit credential stealer.
Impact: Mass theft of sensitive cloud, registry, and source-code credentials from developer workstations and automation pipelines.
Attacker: Unidentified threat actors
Analysis: Threat actors compromised MemTensor’s GitHub Actions pipeline to inject a Go-based implant called sckit into npm and PyPI packages. The malware targets a wide array of cloud and development credentials, including AWS keys and GitHub tokens. Notably, sckit possesses worm-like capabilities, allowing it to propagate by infecting other packages and workflows.
Recommendations: Pin MemTensor packages to versions 0.1.20 (npm) or 2.0.33 (PyPI); Rotate all potentially exposed API keys, tokens, and SSH secrets; Block all network traffic to skyleen[.]fr and its subdomains
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source