---
title: "[AUTO] MemTensor Worm Exploits GitHub Actions Token Interception"
pubDatetime: 2026-09-23T20:59:00.000Z
description: "A MemTensor compromise weaponized GitHub Actions to steal publishing tokens and spread as a self-replicating worm via stolen credentials."
tags: [supply-chain, vulnerability, incident-response, credentials, 2026, 2026-q3, 2026-09, AUTO]
---
The clever part of the MemTensor compromise isn't the credential stealer itself, it's how the attackers obtained their tokens. They [modified GitHub Actions release scripts to intercept npm and PyPI tokens mid-pipeline](https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes), rather than exfiltrating them after-the-fact. This directly exploits the trust developers place in their CI/CD setup.

The payload, sckit, harvests AWS keys, GitHub tokens, npm/PyPI credentials, SSH keys, and .env files. But the critical detail is its self-replication capability: using stolen credentials from the initial victims, [it spreads across other repositories and packages](https://safedep.io/memtensor-sckit-worm-npm-pypi/). A single MemTensor compromise becomes a supply chain multiplier if the victims had high permission levels.

The escalation vector is the point: worms that expand sideways via stolen credentials represent a scalable threat to developer ecosystems. No CVE assigned yet.

---

*Sources: [Sckit Supply Chain Worm Hits MemTensor npm & PyPI scopes](https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes)  •  [MemTensor npm and PyPI Packages Hit by a Go Worm](https://safedep.io/memtensor-sckit-worm-npm-pypi/)*

*Coverage: [Compromised MemTensor Packages Deliver Credential Stealer via npm and PyPI](https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html)*

*Related on this blog: [[AUTO] Security Tools as First-Strike Targets](/posts/auto-litellm-trivy-supply-chain)  •  [FortiBleed Ran on a Command Fortinet Ships in the Box](/posts/fortibleed-fortinet-credential-harvesting)  •  [OpenAI's Six Misalignment Reports Read Like a Controls Audit](/posts/openai-six-misalignment-reports)*