Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs in the background each time the package loads. It collects credentials from the home directory and sends them to servers under skyleen[.]fr. It also includes the code it needs to copy itself into other repositories and packages that the stolen credentials can reach. Credential collection: the implant's `credentialPaths`, `readCredentialFile` and `extractJSONCredentials` functions target `.npmrc`, `.pypirc`, `.git-credentials`, `.netrc`, `id_rsa`, `id_ecdsa`, `id_ed25519`, `.vault-token`, `msal_token_cache`, `access_tokens.json` and `access_tokens.db`. Two regular expressions pick out secrets: one matches secret-like variable names (`token`, `secret`, `password`, `api_key`, `database_url`), the other matches known token formats. C2 protocol: the `internal/wire` package uses CBOR, X25519 key exchange and XChaCha20-Poly1305 (`sckit/xchacha/v1`), and handles signed leases, manifests and modules. The server delivers the modules at run time, so their contents were not observed. `scheduleSelfDelete` and `deleteExecutable` remove the binary after it runs. C2 paths: `/<24 hex>/config` (control), `/status` (preflight), `/batch` (results). Package archive SHA-256 digests: - memos-cloud-openclaw-plugin-0.1.21.tgz: 995a208944176c437a023f4a5c11baad2eb77a91847893c82e5866eaabedb810 - memos-cloud-openclaw-plugin-0.1.23.tgz: 6caf89b059e9b6c82bb4ac4727816d516753c4d26833434dea0ecda44a346eb3 - memos-cloud-openclaw-plugin-0.1.25.tgz: a6870826cd7c7ec8d32af227252efcdcdca03ac956d4702cdc2157ca82641673 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1c533046b0b10308e2664ad7b6322eca047056161df3a4977972ccb1ffe3e349) The npm package advertises itself as a memory plugin but bundles a Go-compiled binary at.sckit/<platform>/sckit for six OS/arch targets whose build path is 'supplychain.local/campaign/cmd/implant'. index.js imports lib/sckit.js, whose launchStageZero() detach-spawns the bundled binary as 'stage0 --config64 <b64>' with stdio ignored and unref()'d, so simply loading the plugin runs the implant in the background. The base64 CONFIG constant in lib/sckit.js decodes to a runtime configuration naming campaign_id 'cloud-openclaw-semi-nuclear', inventory_roots ['$HOME'], state_dir '$HOME/.openclaw/.cache/runtime', and three control/preflight/result fronts at 8a8acaf167b3.skyleen.fr, 0b48fafd6fbe.skyleen.fr, and 266297c6df27.skyleen.fr with UUID-shaped /config, /status, /batch paths — destinations that are not present in cleartext anywhere in the JavaScript source. The configuration's 'channel' field is 'exact-ref-one-use-NPM_TOKEN,@memtensor/memos-cloud-openclaw-plugin', and a companion collectStageZero() invokes the same binary synchronously with '--require-credential-receipt', targeting the installer's npm publishing token as it appears in ~/.npmrc or in CI environment variables. The combination of a bundled native implant auto-executed on plugin load, obfuscated hardcoded C2 fronts, whole-$HOME inventory, and explicit NPM_TOKEN capture is credential theft and host exfiltration against the installer, not the plugin functionality the package name advertises. Binary strings such as 'supplychain.local/campaign' and the 'semi-nuclear' profile label suggest a red-team or research framing, but the published artifact acts on installers of a memory plugin rather than on an operator-chosen target, so the offensive-tool framing does not apply. ## Source: ghsa-malware (392fa28fd3caee9373f574a4e84e36f01d87d366eeb463993b189b95416cec62) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source published

23 Sep 2026 00:00:00 UTC

Source modified

23 Sep 2026 23:00:07 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.