Three Hours, Two Registries, One Memory Framework #
Between 02:23 UTC and 05:55 UTC on September 23, 2026, malicious versions of MemTensor’s MemOS — an open-source memory framework for LLMs and AI agents with roughly 11,500 GitHub stars — appeared on both npm and PyPI. The payload: a cross-platform Go-based credential stealer called sckit. It is the first documented supply-chain worm specifically targeting agent memory infrastructure.
The compromise started with direct commits to MemTensor’s own GitHub repositories, published through the maintainer account leason1974 without a gitHead. Clean versions appeared between malicious ones — 0.1.22 and 0.1.24 on npm — which researchers at Semgrep read as the attacker testing payload optimization while access lasted. The affected versions: npm @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, and 0.1.25; PyPI MemoryOS 2.0.34.
The Evasion: No Hooks, Just Legitimate Code Paths #
Sckit does not use postinstall hooks. Everyone scans those now. Instead, it wires itself into functionality the agent calls anyway.
On the npm side, the malicious versions add lib/sckit.js, which launches a platform-specific Go binary from a hidden .sckit/ directory. The launcher runs at two points: when the OpenClaw agent gateway starts up, and every time the memory-recall hook fires. That second trigger matters — each recall invocation passes the user’s current prompt text to the binary via the SCKIT_EVENT_TEXT environment variable. StepSecurity’s analysis notes this means anything a developer asks the agent while an affected version is loaded should be treated as exposed.
On the Python side, the attack is arguably more elegant. The Hacker News reports that the payload triggers through memos/log.py, where configure_logging() appends a call to memos._stage0.trigger(). Because Python executes module-level statements on import, a simple import memos reaches the logging hook, which reaches the launcher. No install-time scripts needed.
What It Steals, and Where It Sends It #
The sckit binary harvests credentials from 13 categories: npm tokens, PyPI tokens, GitHub and GitLab personal access tokens, AWS access keys, Hugging Face tokens, HashiCorp Vault tokens, Slack tokens, Stripe live keys, SendGrid keys, SSH keys, generic JWTs, and environment variables matching secret-shaped patterns. Captured data routes to command-and-control infrastructure at skyleen[.]fr and its subdomains.
The embedded configuration — decoded from a base64 --config64 argument — names the campaign cloud-openclaw-semi-nuclear, sets $HOME as the inventory root, and configures three external fronts with /config, /status, and /batch endpoints. The campaign’s not_after timestamp corresponds to October 23, 2026.
The Worm That Could #
The binary includes functions named recursivePublish, prepareRemoteNode, prepareRemotePython, and prepareRemoteWorkflow. Embedded GitHub Actions templates request execution on push. The design is clear: steal publishing tokens, use them to push compromised versions of other packages, repeat.
As of this writing, no confirmed downstream spread has been observed. The propagation capability exists in the code; its real-world activation has not been documented.
The Memory Layer Joins the Attack Surface #
This week’s T/I/S coverage has tracked agent security across multiple layers: the kernel (Muse Sentinel’s eBPF taint tracking, Post 130742), the VM (GrokBot’s persistent environment), and the browser. The MemTensor incident adds the package ecosystem — specifically, the memory frameworks agents depend on — to that list.
Three properties make the agent stack an unusually good target for this kind of attack. The credential density is high: agents need access to secrets to function, so the machines running them tend to hold publishing tokens, cloud keys, and API credentials. Few teams threat-model pip install for AI projects. And the prompts themselves carry sensitive data that conventional supply-chain attacks never touched.
What Defenders Should Do #
Pin npm to version 0.1.20 and PyPI to 2.0.33, or remove the packages entirely. Rotate every credential accessible from any environment that imported the affected versions — registry tokens first, then source control, cloud, Vault, SSH keys. Block skyleen[.]fr and all subdomains. Search lockfiles, requirements*.txt, poetry.lock, and SBOMs for the affected package names. Audit your own releases if an affected host held a publish token.