MemTensor MemOS Supply Chain Attack: sckit Triggered by Python Imports and OpenClaw Runtime Hooks

1. Basic Information

• Original Title: The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise
• Source: Semgrep
• Published Date: September 23, 2026
• Updated Date: None
• Severity: critical
• Severity Basis: Binaries targeting Windows, Linux, and macOS are launched from compromised packages from the legitimate MemOS AI memory framework, scanning for tokens belonging to npm, PyPI, GitHub, cloud services, Slack, and others. While self-propagation code is included, spread to public repositories has not been confirmed.
• Original Link: The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise
• Related Sources: Aikido: supplychain.local MemTensor npm/PyPI, StepSecurity: Sckit supply chain worm
• Revision Note: Clarified execution conditions during import and application startup, the distinction between implementation analysis and individual victim impact, and the targets of credential rotation.

2. At a Glance

sckit was embedded in legitimate MemTensor MemOS npm and PyPI distributions. According to implementation analysis by researchers, it does not execute during installation, but rather activates during Python imports or OpenClaw execution to scan for and transmit credentials. The number of successful thefts in individual victim environments has not been publicly disclosed.

3. Attack Flow

The verification and implementation paths indicated by public sources are organized below. For the scope of observation in real environments, refer to "Attack Success Determination."

From Legitimate Package to Credential Scanning and Exfiltration

1. An attacker includes sckit in legitimate npm and PyPI releases.
2. Payload execution is triggered by importing the affected Python package, starting the OpenClaw gateway, or invoking a memory-recall hook in the affected plugin.
3. Platform-specific sckit binaries launch, scanning for credentials from the home directory and tool configurations.
4. Credentials and selected prompt data are sent to destinations under skyleen.fr.

4. Attacker Positioning and Execution Environment

• Attackers placed malicious releases within official package registry distribution channels.
• Execution occurs with user privileges on developer workstations, CI runners, and OpenClaw hosts.

5. Victim and Administrator Perspective

Victims

• Because installation shows no noticeable activity and the payload triggers during normal imports or application startup, successful installation alone does not guarantee safety.

Administrators

• Indicators for investigation include sckit launching from Python or OpenClaw, heavy file access within the home directory, and network traffic directed toward skyleen.fr.

6. Success and Failure Conditions

Success Conditions

• Payload execution is triggered by importing the affected Python package, starting the OpenClaw gateway, or invoking a memory-recall hook in the affected plugin.
• Successful credential exfiltration additionally requires the execution privileges to read credential files and the ability to transmit collected data externally.

Failure Conditions and Risk Mitigation

• Block malicious versions and verify hashes/provenance against gitHead/tag mappings.
• Use short-lived credentials on developer workstations and in CI pipelines. Restrict execution of untrusted binaries and outbound connections to unapproved domains.

7. What Happens Upon Success

• The implementation includes logic to scan and exfiltrate development, cloud, package registry, and SaaS tokens, along with SSH keys and prompt text. Depending on the privileges of the stolen credentials, this could lead to secondary compromise of repositories or releases. This does not describe confirmed success in individual victim environments.

8. Observable Logs

The following items represent investigation guidance for your organization. Not all items indicate that actual victimization occurred.

• Email: No reports identify email as the initial access vector.
• Proxy / SWG / DNS: Check for DNS queries and HTTPS traffic directed toward skyleen.fr.
• Endpoint / EDR: Look for the sckit binary, memos._stage0, OpenClaw child processes, and heavy read operations under the HOME directory.
• Identity / IdP: Verify the usage origins of tokens for GitHub, npm, PyPI, AWS, Slack, and similar services.
• SaaS / Cloud: Review anomalies in CI workflow modifications, package publication, and release provenance.
• Network: Correlate outbound traffic immediately following package execution with registry operations.

9. Attack Success Determination

Confirmed in Public Information

• Malicious Distribution and Execution Path Confirmed: Researchers analyzed implementations where sckit launches from Python imports or OpenClaw execution. Execution records and successful theft counts per organization have not been made public.

Internal Organization Evaluation Criteria

• Malware Execution or Authentication Success Confirmed: Criteria: Verify through process or file records that sckit launched via Python imports or OpenClaw execution from an affected version. Implementation features identified in public analysis alone do not confirm successful execution in individual victim environments. (Scope: Internal investigation criteria; execution records by organization remain unpublicized.)
• Information Theft or Session Compromise Confirmed: Criteria: Validate access to credential files and external transmission using endpoint and network logs. Scanning and exfiltration features identified in public analysis alone do not confirm successful information theft in individual victim environments. (Scope: Internal investigation criteria; individual theft success unconfirmed.)

10. Investigation Playbook

The following outlines recommended investigation and response steps for internal organizations based on public information.

• Starting Point: Begin with the use of malicious versions, sckit execution, and traffic to related domains.
• Initial Response: Preserve lock files and distribution packages, and determine whether the package was merely installed or if import/OpenClaw execution paths were reached.
• Endpoint: Preserve processes, files, services, persistence mechanisms, and EDR telemetry.
• Identity / Cloud: Review tokens, keys, logins, and SaaS/cloud audit logs.
• Follow-up Verification: Track information theft, lateral movement, additional payloads, and configuration changes.
• Containment: Isolate endpoints that executed the affected version to remove payloads, and Revoke and reissue all credentials accessible from affected environments, including package-publishing tokens, source-control credentials, cloud credentials, and SSH keys.
• Triage: Categorize and record contacts, initial execution, authentication/malware success, information compromise, and secondary compromises separately.

11. Defense and Detection Ideas

• Single Events: Investigate sckit launches originating from Python or OpenClaw, mass reading of credential files, and communications with related domains.
• Timeline Analysis: Correlate events from initial entry to execution, credential access, and outbound communication within a short timeframe.
• Threat Hunting: Cross-reference impact windows with asset inventories to proactively search for identical IoCs and behaviors.
• Logging Gaps: Lack of necessary logs limits the ability to determine success stages. Absence of logs should not be interpreted as lack of execution.
• Priority Mitigations: Prioritize replacing affected packages with verified clean versions or removing them, implementing least privilege, controlling outbound traffic, and retaining audit logs.

12. Facts / Inference / Hypothesis

Facts

• The malicious npm versions are @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, and 0.1.25, and the PyPI version is MemoryOS 2.0.34.
• Importing memos triggers logging initialization, which calls memos._stage0.trigger() through the modified configure_logging() function. The npm launcher also passes prompt text to the payload through the SCKIT_EVENT_TEXT environment variable.
• Analyzed distributions include sckit binaries for Windows, Linux, and macOS, equipped with functionality to scan home directories and environment variables for credentials related to npm, PyPI, GitHub, GitLab, AWS, Hugging Face, Vault, Slack, Stripe, SendGrid, JWT, and others.
• Logic exists to transmit collected data to *.skyleen[.]fr, with the npm version also passing prompt text via SCKIT_EVENT_TEXT in the payload. This represents analysis results of the implementation, not proof that data from individual users was actually transmitted.
• While self-propagation templates for GitHub Actions and npm/PyPI publishing were included, Semgrep and Aikido have found no evidence of spread to public workflows or additional packages.

Inference

• Because the analyzed MemTensor releases trigger the payload at runtime rather than during installation, installation monitoring alone may miss execution.

Hypothesis

• The self-propagation features suggest an intent to spread as a worm, but successful propagation has not been observed.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1195.002	Supply Chain Compromise: Compromise Software Supply Chain	high	Mapping based on implementation analysis of published packages. Malicious binaries were mixed into legitimate npm and PyPI package releases.
T1552.001	Unsecured Credentials: Credentials In Files	high	Mapping based on implementation analysis of published packages. Numerous tokens and keys are scanned from beneath the HOME directory.
T1041	Exfiltration Over C2 Channel	high	Mapping based on implementation analysis of published packages. Collected information is transmitted to destinations under skyleen.fr.

14. Gaps and Further Investigation

• Exact initial entry points and timestamps for maintainer account compromises.
• Number of users whose tokens were actually stolen, secondary exploitation, and the presence of self-propagation to private repositories.

15. Impact on SOCs and Organizations

Inspecting installation-time scripts alone will fail to catch logic embedded in normal imports and application startups. Investigate developer workstations and CI runners that executed affected versions under the assumption of compromise. In addition to removing the package, revoke and reissue credentials that were accessible from the execution environment, and verify whether public packages managed by your organization were illicitly modified.

16. Audience-Specific Summary

• SOC: Correlate affected package versions, sckit processes, skyleen.fr, credential read operations under HOME, and anomalous publications.
• Administrators: Switch to clean versions such as npm 0.1.20 or PyPI 2.0.33 as advised by Semgrep (or remove the package), and revoke/reissue credentials potentially exposed from execution endpoints.
• Users: If the affected package was executed, suspend development environment tokens and report to the organizational incident response team.