Blog
2 min read

MemTensor npm and PyPI Packages Compromised With a Self-Spreading Credential Stealer

On 23 September 2026 attackers published malicious versions of @memtensor/memos-cloud-openclaw-plugin on npm and MemoryOS on PyPI carrying a Go implant ("sckit") that steals developer and CI credentials and spreads into other packages its victims publish. Affected versions, how it works, indicators, and the cleanup steps.

On 23 September 2026, an attacker published malicious versions of two packages from the AI-memory project MemTensor:

  • npm: @memtensor/memos-cloud-openclaw-plugin — versions reported as affected include 0.1.21, 0.1.23 and 0.1.25 (Aikido flagged 0.1.21 and later). StepSecurity recommends pinning 0.1.20.
  • PyPI: MemoryOS — 2.0.34 and later, per Aikido.

Security firms (Aikido, StepSecurity, SafeDep) call the payload sckit or "supplychain.local". Their analysis is preliminary; check their latest advisories for version lists.

How it works

  • No install script. Unlike many npm attacks, the malicious npm versions don't use postinstall. The loader is imported into the package's normal code and runs whenever the package is used, so --ignore-scripts alone doesn't help.
  • It launches a cross-platform Go binary (Windows, Linux and macOS on ARM and x86) from a hidden .sckit directory.
  • It harvests secrets — tokens for GitHub, GitLab, npm, PyPI, AWS, Hugging Face, Slack, Stripe, SendGrid, Vault, JWTs; npm token files, SSH keys, cloud CLI credentials, git credential stores and environment variables — and sends them to servers under skyleen.fr.
  • It spreads: using stolen credentials, it publishes itself into other npm and PyPI packages the victim controls, and carries a GitHub Actions workflow template to run on pushes to compromised repositories.

StepSecurity reports the attacker abused MemTensor's GitHub Actions release pipelines; a clean version was even released minutes before another malicious one.

Indicators

  • Domains under skyleen.fr (several random subdomains).
  • IP address 139.84.223.178.
  • A hidden .sckit directory and unexpected Go binaries.

Full hashes are in the vendors' advisories.

What to do if you might be affected

  1. Search lockfiles for the package names and affected versions:
grep -rn "memos-cloud-openclaw-plugin\|MemoryOS" package-lock.json pnpm-lock.yaml yarn.lock requirements*.txt poetry.lock 2>/dev/null
  1. Pin a clean version or remove the package.
  2. Treat affected machines and CI runners as compromised — rebuild them.
  3. Rotate every credential the machine could reach: npm and PyPI tokens, GitHub tokens and SSH keys, cloud keys, API keys in .env files. (Leaked API Key: What to Do)
  4. Check packages you publish for unexpected new versions, and your repos for unfamiliar workflow files.
  5. Block the indicators at your network edge.

The lesson for AI tooling

AI agent plugins and memory libraries are a fast-growing, fast-moving dependency category — and agents often run with broad credentials. Pin versions, review new dependencies, use lockfiles and npm ci, prefer trusted publishing with provenance, and keep long-lived tokens off developer machines and agent sandboxes. (npm Supply Chain Security, SBOMs and Signed Images)

Source: Aikido: MemTensor npm and PyPI hit by supplychain.local malware · StepSecurity analysis

EasySpawn runs each project on its own isolated server, so a compromised dependency can't reach your laptop's keys or other projects — and Claude Code can audit lockfiles across your repos. See how it works or join the waitlist.

Related: AI Hallucinated Packages · npm audit Explained · Secrets Management Beyond .env Files · keyv npm Worm

Keep reading