How Ossprey protects from novel AI-accelerated malware development, and cross-ecosystem supply-chain attacks.

This morning, Ossprey Security detected malicious versions of two MemTensor packages. @memtensor/memos-cloud-openclaw-plugin on npm (0.1.21, 0.1.23, 0.1.25) and memoryos on PyPI (2.0.34). Each of these malicious versions carried a novel Golang malware known as sckit -- a credential-stealing worm that scans environments for keys, tokens and secrets and then re-publishes itself wherever possible - not unlike other token stealers that we have covered before, like the Shai-Hulud attack, and the TeamPCP campaign.

Having covered similar attacks before, we instead decided to explore the risks this category of attack create. As always you'll be able to find IOCs for threat-hunting and securing your own environments at the bottom of this page.

Many supply chain attacks begin with fake profiles, typo-squatted libraries; lures and luck to draw victims into down and installing malware. Others begin with account compromises and takeovers, where known and trusted maintainer accounts are used to publish malware. In this case, the initial publish was caused by a mis-configured Github action.

The chain started with a forged commit in the MemTensor/MemOS repository, parented directly on the main branch but never merged into it, authored by an identity that doesn't exist:

An initial indicator of malicious activity is the email. The .invalid TLD is the one the standards reserve for things that are, by definition, not real. A second forged commit followed under a fake release-maintenance identity (no such GitHub account exists), and the two together added the implant and swapped the build backend.

An otherwise normal Github action, pinned to a legitimate pypa commit, handed the maintainer's real PyPi token to attacker code running in the same job, which used it to publish and upload a malicious version of the package to PyPi. On the NPM side the attacker was also able to push malicious updates, however we have been unable to confirm the initial source of the NPM publish permissions.

In fact we have seen many prominent supply-chain attacks begin like this, with this attack class being known as poisoned pipeline execution (PPE).

The lesson generalises past PyPI and past MemTensor. A workflow triggered by release: published which publishes with a stored secret is a machine where the ability to create a release is the ability to publish.

Most organisations that would never hand a developer the production publishing token have a CI job that grants exactly that power to anything that can tag a release. Audit it the way you audit credential access: which humans, which tokens, which other workflows can cause this job to run, and what can it publish?

By taking a brief look now at the malware, and we see a focus on cross-platform operability. The malware was compiled to be executable on every major platform and distribution, ensuring the widest possible reach, from a developer's macbook or thinkpad, to CI/CD and linux systems. During our analysis of the malware we found that it identifies itself as supplychain.local/campaign with 2 separate campaign identifiers cloud-openclaw-semi-nuclear, and memos-semi-nuclear.

In the last year or so the malware coverage and the defenders have spent considerable time defending against a particular attack vector: npm install scripts . We have seen extensive abuse of this and Microsoft, who owns Github and NPM have put significant resource into trying to mitigate this issue, it hasn't completely solved the problem. You can find more of our coverage on Shai-Hulud hitting 2000 npm packages and npm v12 blocking install scripts by default. As defenders have evolved, so too have attackers.

This specific malware used 3 execution channels.

Import-time execution means installing nothing and running nothing is not enough, merely importing the package launches the implant. The swapped build backend means the malware executes inside the CI job that's building the release, where it can append BASH_ENV to the job's environment file, poisoning every subsequent shell in the job.

The bridge it installs then lies in wait for the exact step that uploads to PyPI, grabs the token intended for that upload, and delivers a second-stage payload.

The key point to recognise: every lifecycle event that implicitly executes code, build backends, environment files, shell init hooks, plugin s, logging configuration acts as an equivalent to install hook scripts. Ossprey Security is able to protect from these by not solely relying on known attack vectors but detecting malicious and risky behaviour wherever it may be configured, at the package, repo or pull-request level.

Alongside stealing secrets and tokens, the affected package is an AI agent gateway.

The plugin's dropper runs at gateway startup and again on every memory recall, which happens with each prompt, handing the raw prompt text to the implant. Everything users typed into their AI agent from source code, credentials pasted in frustration to internal plans was sent to the attacker.

AI tooling has been a significant part of the engineer toolset and is placed in a position where inference providers have visibility of the most sensitive data in your organisation, and code harnesses are perfectly positioned to have access to code, tooling and the ability to run and install arbitrary scripts.

Domains and URLs defanged ([.], hxxps); strip brackets for tooling. All hashes verified against registry-published artifacts on 2026-09-23. Affected versions

- npm: `@memtensor/memos-cloud-openclaw-plugin`**0.1.21, 0.1.23, 0.1.25** (0.1.25 is` latest` at time of writing)
- PyPI: `memoryos`**2.0.34**

• Verified clean pins: plugin 0.1.20 (0.1.22 and 0.1.24 are byte-equivalent rebuilds of it), memoryos2.0.33

Domains

URLs (C2 paths) Implant binaries (Go 1.27.1, module supplychain.local/campaign/cmd/implant)

The six npm binaries are byte-identical across 0.1.21 / 0.1.23 / 0.1.25 — only the launcher changed between versions.

Distribution and component files

Forged GitHub commits

Embedded key material (Ed25519 public keys, base64)

C2-side pins (from _pypi_bridge.sh) Hunting strings

Filesystem paths and environment

Kill-switch timestamps

MITRE ATT&CK #

Built from confirmed behaviors in the published artifacts and recovered binary symbols.