Affected Systems

MemTensor packages: npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25; PyPI package MemoryOS version 2.0.34 (now quarantined). Malicious Go-based credential stealer targets Windows, Linux, and macOS systems. Attackers obtained publish tokens via compromised GitHub Actions workflows.

Exploitation Status

Active supply chain attack. Malicious npm package versions remain available for download as of reporting. Attacker compromised legitimate packages by stealing npm and PyPI publish tokens from GitHub Actions CI/CD pipelines. Implant includes worm-like self-propagation capabilities through GitHub and package registries.

Business Impact

Organizations using affected MemTensor packages face credential theft from developer workstations and CI/CD pipelines. The sckit stealer harvests npm tokens, PyPI API keys, AWS credentials, GitHub/GitLab tokens, SSH keys, Vault tokens, and environment variables containing secrets. Exfiltration occurs to skyleen[.]fr. Worm functionality enables lateral spread through compromised credentials, potentially affecting additional packages and repositories beyond MemTensor.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify systems with @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25 or MemoryOS 2.0.34 installed via dependency scanning
  • Pin MemTensor packages to safe versions: 0.1.20 for npm package, 2.0.33 for PyPI package, or remove entirely if not required
  • Kill all running sckit processes on affected systems and block network access to skyleen[.]fr and all subdomains at firewall/DNS level
  • Rotate all developer credentials and CI/CD secrets on affected systems including npm tokens, PyPI API keys, AWS access keys, GitHub/GitLab tokens, SSH keys, and Vault tokens
  • Audit GitHub Actions workflows for unauthorized commits that may have exposed publish tokens; review workflow logs for credential exposure between compromise window
  • Monitor for unauthorized package publishes to npm/PyPI registries and unexpected GitHub repository modifications using compromised credentials

---

# Threat Actor Context

Actor Profile

Unknown threat actors conducted a supply chain attack targeting the software development ecosystem. The attackers compromised legitimate MemTensor packages on npm and PyPI repositories by obtaining publish tokens from MemTensor's GitHub Actions release pipelines. The actor pushed commits that caused CI/CD workflows to expose npm and PyPI tokens, enabling them to publish malicious package versions. Motivation appears to be credential harvesting from developer environments and CI/CD pipelines, with potential for further supply chain propagation through worm-like capabilities.

TTPs (Tactics, Techniques, Procedures)

The attack leverages supply chain compromise (T1195.001 - Compromise Software Dependencies and Development Tools) by poisoning legitimate packages. Initial access occurs through package installation triggering malicious code execution. The sckit implant performs credential access (T1552.001 - Credentials In Files, T1552.004 - Private Keys) by harvesting .npmrc, .vault-token, SSH keys, AWS credentials, and various API tokens. It also performs T1552.007 (Container API) and T1087 (Account Discovery) by targeting cloud service credentials. The malware exfiltrates data (T1041 - Exfiltration Over C2 Channel) to skyleen[.]fr. It includes self-propagation capabilities resembling T1080 (Taint Shared Content) by installing itself in npm packages, Python packages, and GitHub Actions workflows, functioning as a worm. Command and control (T1071 - Application Layer Protocol) is achieved through signed tasks from the C2 server.

Targets & Patterns

The campaign specifically targets software developers and DevOps engineers working with npm and PyPI ecosystems. Primary victims include organizations using MemTensor's AI memory integration packages (@memtensor/memos-cloud-openclaw-plugin and MemoryOS). The attack focuses on developer workstations and CI/CD environments where credentials for cloud services (AWS, GitHub, GitLab), package registries (npm, PyPI, Hugging Face), and developer tools (HashiCorp Vault, Slack, Stripe, SendGrid) are present. The malicious plugin integrates into OpenClaw agent runtime and Clawdbot/Moltbot runtimes, positioning itself in processes that handle user input and inherit valuable credentials. CI/CD pipelines are particularly attractive targets as they often have elevated privileges and access to publishing tokens, enabling further supply chain compromise.

Historical Context

This attack follows established patterns of supply chain compromise through package repository poisoning, similar to previous incidents involving compromised npm and PyPI packages. The technique of compromising CI/CD pipelines to obtain publishing credentials represents an evolution in supply chain attack sophistication. The worm-like self-propagation capability through GitHub Actions and package publishing distinguishes this campaign from typical typosquatting or dependency confusion attacks. As of the reporting date (September 23, 2026), the full scope of compromised packages beyond MemTensor remains unclear, suggesting potential for broader impact. The malicious npm package versions (0.1.21, 0.1.23, 0.1.25) remain available for download at time of reporting, indicating ongoing exposure risk.

Defensive Recommendations

  • Pin MemTensor packages to safe baseline versions: @memtensor/memos-cloud-openclaw-plugin version 0.1.20 or 0.1.22/0.1.24, and MemoryOS version 2.0.33 or earlier
  • Block network communications to skyleen[.]fr and all subdomains at perimeter and endpoint firewalls to prevent credential exfiltration
  • Hunt for and terminate any processes named 'sckit' or matching the Go-based implant signatures across Windows, Linux, and macOS endpoints
  • Rotate all exposed secrets including npm tokens, PyPI API tokens, AWS access keys, GitHub/GitLab tokens, Vault tokens, SSH keys, and API keys for Slack, Stripe, SendGrid, and Hugging Face
  • Implement integrity checks for GitHub Actions workflows and CI/CD pipelines to detect unauthorized modifications that expose publishing tokens (T1195.001 detection)
  • Monitor for suspicious credential file access patterns targeting .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json, and environment variables containing tokens or API keys (T1552.001/T1552.004 detection)
  • Enable dependency scanning tools (Aikido, SafeDep, Socket, StepSecurity) to detect malicious packages before installation and monitor for anomalous post-install scripts