@memtensor/memos-cloud-openclaw-pluginnpm

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs in the background each time the package loads. It collects credentials from the home directory and sends them to servers under skyleen[.]fr. It also includes the code it needs to copy itself into other repositories and packages that the stolen credentials can reach.

Credential collection: the implant's credentialPaths, readCredentialFile and extractJSONCredentials functions target .npmrc, .pypirc, .git-credentials, .netrc, id_rsa, id_ecdsa, id_ed25519, .vault-token, msal_token_cache, access_tokens.json and access_tokens.db. Two regular expressions pick out secrets: one matches secret-like variable names (token, secret, password, api_key, database_url), the other matches known token formats.

C2 protocol: the internal/wire package uses CBOR, X25519 key exchange and XChaCha20-Poly1305 (sckit/xchacha/v1), and handles signed leases, manifests and modules. The server delivers the modules at run time, so their contents were not observed. scheduleSelfDelete and deleteExecutable remove the binary after it runs.

C2 paths: /<24 hex>/config (control), /status (preflight), /batch (results).

Package archive SHA-256 digests:

• memos-cloud-openclaw-plugin-0.1.21.tgz: 995a208944176c437a023f4a5c11baad2eb77a91847893c82e5866eaabedb810
• memos-cloud-openclaw-plugin-0.1.23.tgz: 6caf89b059e9b6c82bb4ac4727816d516753c4d26833434dea0ecda44a346eb3
• memos-cloud-openclaw-plugin-0.1.25.tgz: a6870826cd7c7ec8d32af227252efcdcdca03ac956d4702cdc2157ca82641673

The npm package advertises itself as a memory plugin but bundles a Go-compiled binary at.sckit/<platform>/sckit for six OS/arch targets whose build path is 'supplychain.local/campaign/cmd/implant'. index.js imports lib/sckit.js, whose launchStageZero() detach-spawns the bundled binary as 'stage0 --config64 <b64>' with stdio ignored and unref()'d, so simply loading the plugin runs the implant in the background. The base64 CONFIG constant in lib/sckit.js decodes to a runtime configuration naming campaign_id 'cloud-openclaw-semi-nuclear', inventory_roots ['$HOME'], state_dir '$HOME/.openclaw/.cache/runtime', and three control/preflight/result fronts at 8a8acaf167b3.skyleen.fr, 0b48fafd6fbe.skyleen.fr, and 266297c6df27.skyleen.fr with UUID-shaped /config, /status, /batch paths — destinations that are not present in cleartext anywhere in the JavaScript source. The configuration's 'channel' field is 'exact-ref-one-use-NPM_TOKEN,@memtensor/memos-cloud-openclaw-plugin', and a companion collectStageZero() invokes the same binary synchronously with '--require-credential-receipt', targeting the installer's npm publishing token as it appears in ~/.npmrc or in CI environment variables. The combination of a bundled native implant auto-executed on plugin load, obfuscated hardcoded C2 fronts, whole-$HOME inventory, and explicit NPM_TOKEN capture is credential theft and host exfiltration against the installer, not the plugin functionality the package name advertises. Binary strings such as 'supplychain.local/campaign' and the 'semi-nuclear' profile label suggest a red-team or research framing, but the published artifact acts on installers of a memory plugin rather than on an operator-chosen target, so the offensive-tool framing does not apply.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.