MemTensor npm, PyPI packages compromised with cross-platform credential stealer

A Go binary called sckit was added to four malicious releases, targeting developer secrets.