MemTensor npm, PyPI packages compromised with cross-platform credential stealer

MemTensor’s MemOS Cloud OpenClaw Plugin on npm and MemoryOS framework on PyPI were compromised early Wednesday, adding cross-platform Go malware capable of stealing developer credentials, Socket reported.

MemoryOS, or MemOS, is a memory system for large language models (LLMs) and AI agents that has about 11,500 stars and 1,100 forks on GitHub.

Three malicious versions of MemOS OpenClaw lifecycle plugin (@memtensor/memos-cloud-openclaw-plugin) — 0.1.21, 0.1.23 and 0.1.25 — and one malicious version of the MemOS Python package — 2.0.34 — were published by an attacker, all containing a malicious Go binary called “sckit.”

Socket noted that the npm releases were published by an account that had previously published legitimate releases (leason1974) but did not come from the project’s normal continuous integration (CI) workflow as they lacked a gitHead, suggesting an account compromise.

For the npm versions, the malicious binary executes when the OpenClaw gateway starts and then executes again every time a memory recall occurs when the user submits a prompt. The PyPI version launches as soon as the package is imported.

Related reading:

A static analysis of the malware by Socket revealed that it first determines the victim’s operating system, with binaries supporting Linux, macOS and Windows on both x64 and arm64 architectures, before targeting credentials and secrets for platforms including npm, PyPI, GitHub, GitLab, AWS, HashiCorp Vault, Hugging Face, Slack, Stripe and SendGrid, as well as SSH secrets.

“The binaries also contain strings about encoding package manifests and installing repository files. This suggests they may be able to republish packages with stolen registry tokens, indicating a potential worm behavior pattern,” the Socket researchers wrote.

Socket recommended all users of the MemOS OpenClaw plugin and MemOS Python package pin the last safe versions (0.1.20 on npm and 2.0.33 on PyPI) and assume any environments that loaded the malicious versions are compromised.

On hosts where the malicious versions were installed, the malicious versions should be uninstalled, running sckit processes should be terminated and any remaining package directories should be deleted. Any secrets reachable from the affected user’s $HOME environment should be rotated.

In all versions, the malware communicates with the command-and-control (C2) domain skyleen[.fr – defenders should block this domain and all of its subdomains and review logs for recent connections to this domain.

The npm plugin also exposed OpenClaw prompts to the attacker, and users should assume any secrets included in prompts while a malicious plugin was installed have been compromised. Lastly, developers should review recent releases of their own npm and PyPI packages for any unexpected publications.