sckit worm in MemTensor npm plugin and PyPI MemoryOS

StepSecurity documented malicious releases of the legitimate MemTensor
AI-memory plugin @memtensor/memos-cloud-openclaw-plugin on 23 September
2026. Versions 0.1.21, 0.1.23, and 0.1.25 added lib/sckit.js and
platform-native .sckit binaries. There was no install/preinstall/
postinstall script: the plugin's own gateway-startup and memory-recall
paths import launchStageZero, spawn a detached sckit binary with
--config64, copy the parent environment (including credentials), and
on recall also pass the user's prompt as SCKIT_EVENT_TEXT. Clean
0.1.22 and 0.1.24 restored the package; malicious contents returned
3 minutes 36 seconds and 3 minutes 28 seconds later. Unpacked size
jumped from ~272 KB to ~43.6 MB. MemTensor issue 173 reports npm
artifacts with no matching git commits or tags, so publishing
credentials were used rather than the source repo. An uncalled
collectStageZero helper maps NPM_TOKEN/NODE_AUTH_TOKEN. PyPI
MemoryOS 2.0.34 is the Python counterpart: a logging-init hook in
configure_logging() reaches the launcher on import, six hashed
payloads, and a hash-pinned CI delivery chain. Binary strings name
recursivePublish and a GitHub Actions template; StepSecurity treats
those as intended propagation, not observed extra publishes.

Mapped techniques

T0112 Compromised token
T0121 Compromised legitimate artifact
T0109 Publish malicious artifact
T0159 Malicious artifact execution
T0140 Harvest tokens from environment variables
T0184 Harvesting sensitive information from files
T0193 Sensitive information in environment variables

supply-chain Compromised MemTensor npm plugin

T0112 · Initial Access · Compromised token

npm artifacts had no matching git commits or tags; publish credentials, not the repo.

T0121 · Resource Development · Compromised legitimate artifact

Real @memtensor/memos-cloud-openclaw-plugin versions 0.1.21/0.1.23/0.1.25.

T0109 · Resource Development · Publish malicious artifact

Three malicious npm versions on 23 Sep; latest pointed at 0.1.25.

T0159 · Execution · Malicious artifact execution

No install scripts; launcher runs from gateway startup and memory-recall.

T0140 · Credential Access · Harvest tokens from environment variables

Child inherits process.env; collectStageZero maps NPM_TOKEN/NODE_AUTH_TOKEN.

T0184 · Credential Access · Harvesting sensitive information from files

Decoded config sets inventory_roots to $HOME; binary strings match cloud, VCS, and registry tokens.

T0193 · Collection · Sensitive information in environment variables

Parent env plus SCKIT_EVENT_TEXT (user prompt on recall) are handed to the detached binary.

supply-chain PyPI MemoryOS 2.0.34

T0121 · Resource Development · Compromised legitimate artifact

MemoryOS 2.0.34 on PyPI; same sckit payload family.

T0109 · Resource Development · Publish malicious artifact

Wheel/sdist include six platform binaries via a custom Poetry build backend.

T0159 · Execution · Malicious artifact execution

Import of memos reaches configure_logging() then memos._stage0.trigger().

T0140 · Credential Access · Harvest tokens from environment variables

Python launcher copies os.environ into the child; CI helper can inherit INPUT_PASSWORD.

Framework gaps noted

HTTP C2 fronts on skyleen.fr (/config, /status, /batch) are not a named technique.
recursivePublish / GitHub Actions implant strings in the binary are intended worm behaviour; extra victim publishes were not shown.
Passing the user's memory-recall prompt as SCKIT_EVENT_TEXT is not a named technique.

sckit worm in MemTensor npm plugin and PyPI MemoryOS

Mapped techniques

supply-chain Compromised MemTensor npm plugin

supply-chain PyPI MemoryOS 2.0.34

Framework gaps noted

Sources