MemTensor (npm @memtensor/memos-cloud-openclaw-plugin, PyPI MemoryOS): packages compromised with 'supplychain.local' Go worm that executes on invocation and self-propagates via package publishing and compromised GitHub Actions (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-09-23
On 23 September 2026 a threat actor published malicious versions of npm package @memtensor/memos-cloud-openclaw-plugin (=0.1.21) and PyPI package MemoryOS (=2.0.34), both of which have substantial benign publishing histories and appear compromised. The malware, tracked as 'supplychain.local', embeds language-native droppers (JavaScript/Python) that launch a hidden platform-specific Go binary ('sckit') from a .sckit directory with a base64-encoded config containing C2 endpoints (skyleen.fr domains). It executes on any invocation of the package (not at install time), harvests NPMTOKEN/NODEAUTHTOKEN from the environment, and the Go worm self-propagates by publishing to other packages and via compromised GitHub Actions. Affected users are anyone invoking these versions; pin to last-known-good versions, rotate tokens, and audit for compromise.
What to do
- Immediately remove/pin affected versions: npm @memtensor/memos-cloud-openclaw-plugin >=0.1.21 and PyPI MemoryOS >=2.0.34; downgrade to last known-good versions
- Rotate all npm/NPM_TOKEN and NODE_AUTH_TOKEN credentials and other secrets that may have been exposed on machines that ran the packages
- Hunt for indicators of compromise: hidden .sckit directories, sckit/sckit.exe binaries, $HOME/.openclaw/.cache/runtime state dir, and network connections to *.skyleen.fr hosts
- Audit GitHub Actions workflows and package publishing activity for signs of worm propagation or unauthorized publishes
- Scan build and CI environments for the worm and review dependency trees for packages published via compromised tokens
Sources
All live incidents on Threat Watch
