Aikido Analyzes Suspected npm and PyPI Supply-Chain Worm
Summary
Aikido’s preliminary analysis of a Go worm found in two npm/PyPI packages describes cross-platform droppers, GitHub Actions and package-publishing propagation, and searches for credentials including npm, PyPI, GitHub and cloud tokens.
Key points
- Aikido reports finding the worm in @memtensor/memos-cloud-openclaw-plugin versions 0.1.21 and later, and MemoryOS versions 2.0.34 and later; both packages appear to have been compromised.
- The packages execute a platform-specific Go binary when invoked, but Aikido says the malware does not appear to run at installation time. Binaries are included for Windows, Linux and macOS on ARM and x86 systems.
- The configuration identifies three apparent command-and-control domains: hxxps://8a8acaf167b3[.]skyleen[.]fr, hxxps://0b48fafd6fbe[.]skyleen[.]fr and hxxps://266297c6df27[.]skyleen[.]fr.
- The worm appears designed to propagate through compromised GitHub repositories and direct npm and PyPI publishing. Aikido says it had not identified public compromised workflow files or repositories containing the propagation stubs at the time of writing.
- The malware searches for credentials and tokens including AWS, GitHub, GitLab, npm, PyPI, Hugging Face, Vault, Slack, Stripe and SendGrid, and appears able to use stolen credentials to publish packages.
Article Details
- Attack Vectors
- Compromised npm and PyPI packages execute a platform-specific sckit binary when invoked; the article says execution does not appear to occur at install time.
- The worm is intended to propagate by publishing packages directly to npm and PyPI using credentials stolen from infected workstations or CI environments.
- A GitHub Actions template is designed to trigger the malware on pushes to compromised repositories; no compromised public workflow files had been identified at the time of writing.
- JavaScript and Python stubs are intended to execute the malware from other infected repositories.
- Defensive Notes
- The article recommends checking Aikido's central feed for malware issues and triggering a manual rescan rather than relying only on nightly rescans.
- The article recommends Aikido Safe Chain to check packages before installation and Aikido Device Protection to monitor software packages installed on team devices.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 0b48fafd6fbe[.]skyleen[.]fr | Listed as an IOC domain; the malware configuration identifies it as an HTTPS front with control, status, and result paths. |
| DOMAIN | 266297c6df27[.]skyleen[.]fr | Listed as an IOC domain; the malware configuration identifies it as an HTTPS front with control, status, and result paths. |
| DOMAIN | 73376a079d87[.]skyleen[.]fr | Listed as an IOC domain associated with the worm. |
| DOMAIN | 8a8acaf167b3[.]skyleen[.]fr | Listed as an IOC domain; the malware configuration identifies it as an HTTPS front with control, status, and result paths. |
| DOMAIN | c747d139e7e9[.]skyleen[.]fr | Listed as an IOC domain associated with the worm. |
| DOMAIN | d4f77a3a8cb0[.]skyleen[.]fr | Listed as an IOC domain associated with the worm. |
| IPV4 | 139[.]84[.]223[.]178 | Listed as the IP address resolved to by all known worm-related subdomains. |
| SHA256 | 381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18 | SHA-256 hash listed for an sckit malware binary. |
| SHA256 | 56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be | SHA-256 hash listed for an sckit malware binary. |
| SHA256 | 65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31 | SHA-256 hash listed for an sckit malware binary. |
| SHA256 | d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26 | SHA-256 hash listed for an sckit malware binary. |
| SHA256 | e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26 | SHA-256 hash listed for an sckit malware binary. |
| SHA256 | f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce | SHA-256 hash listed for an sckit malware binary. |
MITRE ATT&CK
T1059.006 · PythonA Python stub is designed to launch the sckit binary from infected repositories.T1059.007 · JavaScriptA JavaScript stub is designed to launch the sckit binary from infected repositories.T1071.001 · Web ProtocolsThe malware configuration contains HTTPS fronts with control, status, and result paths that the article describes as apparent command-and-control domains; actual communications are not confirmed in the preliminary analysis.T1195.002 · Compromise Software Supply ChainMalicious versions were published to npm and PyPI packages with substantial benign publishing histories; the article says the packages appear to have been compromised.T1552.001 · Credentials In FilesThe malware contains a Go regular expression for searching secrets, including tokens and keys, and is reported to use stolen package-publishing credentials.