Aikido flags self-propagating malware in trusted packages, with execution shifting from install-time to runtime behavior
A compromised npm package linked to Memtensor is being used to distribute a self-propagating supply chain worm capable of spreading across repositories and package registries, according to security firm Aikido. The malware, also identified in a related PyPI package, executes when the package is invoked and is designed to replicate using stolen credentials and automated publishing workflows.
Aikido said the malicious code was found in the npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS, both of which had established publishing histories before being compromised.
Execution shifts from install-time to runtime
Aikido said the malware is embedded as a multi-platform Golang binary executed through loaders within the package. The code runs when the package is invoked, rather than during installation, marking a shift from earlier supply chain attacks that relied on install-time scripts.
The malware deploys platform-specific binaries from hidden directories and executes them with encoded configuration data that includes identifiers and command-and-control endpoints, the company said.
Katie Paxton-Fear, ethical hacker and staff security advocate at Semgrep, said this change in execution behavior could make detection more difficult for teams focused primarily on install-time monitoring.
“MemTensor’s poisoned Python package skipped the suspicious install script and waited for an app to import it,” she said. “That’s a nasty shift for teams watching only what happens during installation.”
She added that the npm plugin also passed prompt text to the malware, which could expose sensitive information processed during normal application use.
Worm designed to spread through developer ecosystems
Aikido said the malware includes functionality to self-propagate through GitHub repositories and package registries. It contains a GitHub Actions template that can trigger execution automatically on code pushes in compromised repositories.
The malware also includes JavaScript and Python stubs intended to execute in other repositories, potentially via post-install scripts, further extending its reach across environments.
In addition, Aikido said the malware is capable of publishing new malicious packages to npm and PyPI using stolen credentials, leveraging standard tools such as npm publish and twine upload.
Paxton-Fear said similar worm-like campaigns have previously used stolen publishing tokens to expand rapidly across ecosystems.
“We’ve seen npm worms steal publishing tokens and turn one compromised maintainer into hundreds of poisoned releases,” she said.
She added that while the Memtensor malware seeks npm and PyPI credentials, there is currently no evidence that it has spread further through republished packages.
Credential harvesting and lateral movement
Aikido said the malware scans infected environments for a wide range of sensitive data, including cloud credentials, repository tokens, API keys, and other secrets.
The code includes pattern matching to identify credentials across developer environments, enabling potential lateral movement into CI/CD pipelines, cloud infrastructure, and source code repositories.
The malware also attempts to store state locally and maintain persistence, according to Aikido’s analysis.
Enterprise impact: software supply chain exposure
The campaign underscores ongoing risks in software supply chains, particularly for organizations relying on open-source dependencies and automated development pipelines.
Security: Aikido said the malware executes during normal package usage, increasing the likelihood of undetected compromise in development environments. The credential harvesting capability raises the risk of broader system access.
Infrastructure: The use of GitHub Actions as a propagation vector introduces risk into CI/CD pipelines, where malicious code could execute automatically on routine workflows.
Risk management: The compromise of previously trusted packages highlights the challenge of detecting malicious updates in dependencies with established reputations.
Governance: The malware’s ability to publish packages using stolen credentials creates the potential for secondary supply chain infections if credentials are not secured.
Broader trend: evolving supply chain attack techniques
The Memtensor incident reflects a broader shift in supply chain attacks toward runtime execution and automated propagation. Recent campaigns have similarly targeted developer ecosystems by stealing credentials and using them to publish additional malicious packages, expanding their reach across repositories and organizations.
The use of cross-platform binaries, multi-language stubs, and CI/CD integration points indicates a focus on persistence and scalability within developer environments.
What enterprises should do next
Aikido said users should review their environments for affected package versions and trigger security scans to detect potential infections.
Paxton-Fear advised organizations that used affected versions to rotate credentials and review publishing activity.
“Teams that used affected versions should rotate reachable credentials and check whether anything was published under their name,” she said.
