A pushed commit pulled MemTensor's npm and PyPI publish tokens out of its own release workflow
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
The Watch · Security desk
What happened
- Unknown actors compromised two legitimate MemTensor packages, one on npm and one on PyPI, to ship sckit, a Go credential stealer built in platform-specific form for Windows, Linux and macOS.
- On npm, versions 0.1.21, 0.1.23 and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin carry the payload, while versions 0.1.22 and 0.1.24 are clean.
- The payload harvests credentials from cloud services, source-code platforms, package registries and developer tools, and exfiltrates them to skyleen[.]fr.
- SafeDep says the attacker took the publish tokens from MemTensor's own GitHub Actions release pipelines by pushing commits that made the workflow hand over the npm or PyPI token.
Why it matters
- Who's exposed exposure A CI job that resolved one of the malicious versions should be treated as having leaked whatever secrets were injected for that run. The rotation list is per pipeline, not per workstation.
- What it limits constraint A pin to 0.1.24 is clean and a pin one release later is not, so triage has to be done per lockfile entry.
- Who has to decide decision Prompt text left the host alongside the process environment, so responders have to decide how to treat whatever users typed into agents during recall; token rotation does not cover it.
- What's now possible capability With templates for npm packages, Python packages and GitHub Actions workflows, every token the stealer collects becomes a means to publish the next poisoned release somewhere else.
Next story · Build · yesterday
GhostAction's secret-stealing workflows reached 30,000 repos through hijacked developer accounts, researchers sayConfirmed2 publishers
"It collects credentials from developer machines and from CI jobs," SafeDep said. "It receives signed tasks from a command-and-control (C2) server. It also contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows." [13][14] The reports also describe the implant as able to self-proliferate through GitHub and through direct npm and PyPI publishing. [12]
Nothing about the install looks wrong: the package name, the registry and the publishing pipeline are the project's own. [11] The only signal is the version number, and the malicious versions are scattered through the series. Of the six releases from 0.1.20 to 0.1.25, three carry the payload and the three clean ones sit between them. [3][21]
The recommended npm baseline, 0.1.20, is five releases behind 0.1.25, and on PyPI the baseline 2.0.33 is one release behind 2.0.34. [22] The malicious npm versions were still available for download when the advisories went out; PyPI has quarantined the MemoryOS project. [15][4]
StepSecurity said the npm versions "contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event", and that "The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable." [5][6] Recall happens before the agent processes a prompt, as part of the plugin's ordinary work, and the package declares integration points for the Clawdbot and Moltbot runtimes. [18] The PyPI trigger is cruder: import the memos module and the statically linked Go binary starts, with no agent run required. [7][23]
"This places the plugin inside a process that routinely handles user input and may inherit valuable credentials," StepSecurity said. [19] On a developer workstation, that process runs as a user account that can reach cloud configuration, source repositories, package publishing tokens and application secrets. [20] Socket's target list includes the files .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens, environment variables such as NPM_TOKEN and PYPI_API_TOKEN, and keys for AWS, GitHub, GitLab, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid. [9][10]
Whether any package outside MemTensor was published with tokens taken in this compromise was unclear as of the four reports. [17] The reporting does not date the publication of the malicious versions. [16] The advisories recommend pinning to 0.1.20 and 2.0.33, rotating exposed secrets, killing any sckit process, and blocking skyleen[.]fr and all its subdomains. [15]
What to watch
- Whether any package outside MemTensor turns out to have been published with tokens taken in this compromise.
- Whether npm removes 0.1.21, 0.1.23 and 0.1.25 as PyPI quarantined MemoryOS, or leaves them installable.
- Whether the signed-task channel is seen issuing the self-install templates into third-party repositories and workflows.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Unknown threat actors compromised two legitimate MemTensor packages across npm and the Python Package Index to push a platform-specific Go-based implant dubbed sckit, designed for Windows, Linux and macOS.
- [2]
The compromise is documented in reports from Aikido, SafeDep, Socket and StepSecurity.
- [3]
On npm, @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25 are malicious; versions 0.1.22 and 0.1.24 are clean.
- [4]
On PyPI, MemoryOS version 2.0.34 is affected, and the project is currently quarantined on PyPI.
- [5]
StepSecurity said the malicious npm package versions include a "hidden Go payload into a legitimate AI memory integration. Versions 0.1.21, 0.1.23, and 0.1.25 contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event".
- [6]
StepSecurity said: "The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable."
- [7]
The PyPI package starts the statically-linked Go binary as soon as the "memos" module is imported into an application.
- [8]
In both ecosystems the end goal is a cross-platform credential-stealing payload capable of harvesting sensitive data from cloud services, source-code platforms, package registries and developer tools, exfiltrating the details to an external server, skyleen[.]fr.
- [9]
According to Socket, targets include npm, PyPI, GitHub, GitLab, AWS, Vault and SSH secrets, including the credential files .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens.
- [10]
According to Socket, the stealer also collects environment variables indicating tokens, passwords, API keys, private keys, session cookies and database or message-broker connection strings (for example NPM_TOKEN and PYPI_API_TOKEN), plus AWS access keys, GitHub and GitLab tokens, npm and PyPI tokens, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid keys, and JWTs.
- [11]
SafeDep said the attacker obtained the publish tokens from MemTensor's own GitHub Actions release pipelines by pushing commits that caused the workflow to hand over the npm or PyPI token.
- [12]
Examination of the implant suggests it can function like a worm, self-proliferating through GitHub and direct npm and PyPI package publishing.
- [13]
"It collects credentials from developer machines and from CI jobs," SafeDep said.
- [14]
SafeDep said: "It receives signed tasks from a command-and-control (C2) server. It also contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows."
- [15]
The malicious versions of the npm packages are still available for download, and the recommended response is to pin to a safe baseline version (0.1.20 for the npm package, 2.0.33 for the PyPI package), rotate exposed secrets, kill any sckit process, and block skyleen[.]fr and all its subdomains.
- [16]
The Hacker News report on the four advisories does not give dates for the publication of the malicious versions.
- [17]
As of the time of writing it is unclear whether packages other than MemTensor's are impacted by the compromise.
- [18]
StepSecurity said the MemOS Cloud plugin connects the OpenClaw agent runtime to a memory service, that its normal work includes recalling relevant memories before an agent processes a prompt and adding memories after a run, and that the package declares integration points for the Clawdbot and Moltbot runtimes.
- [19]
StepSecurity said: "This places the plugin inside a process that routinely handles user input and may inherit valuable credentials."
- [20]
StepSecurity said that on a developer workstation the same user account can have access to cloud configuration, source repositories, package publishing tokens and application secrets, and that in automation the process may receive credentials injected for a particular job.
- [21]
Of the six npm releases from 0.1.20 to 0.1.25, three (0.1.21, 0.1.23, 0.1.25) carry the payload and three (0.1.20, 0.1.22, 0.1.24) are clean, with clean releases interleaved between malicious ones.
- [22]
The recommended npm baseline 0.1.20 is five releases behind the latest listed version 0.1.25, and the recommended PyPI baseline 2.0.33 is one release behind the quarantined 2.0.34.
- [23]
The PyPI trigger fires on module import alone, while the npm trigger requires the agent gateway to start or the plugin to handle a memory-recall event.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comMemTensor npm, PyPI packages compromised with cross-platform credential stealer
1 article · September 24, 2026
- thehackernews.comCompromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
1 article · September 23, 2026
Topics and entities
Topics
- AI Agent Tooling
- Software Supply Chain Security
- CI/CD Pipeline Security
- Credential-Stealing Malware
Entities
- PyPI
- StepSecurity
- MemOS Cloud OpenClaw plugin
- SafeDep
- OpenClaw
- npm registry
- GitHub Actions
- Aikido
- Socket