MemTensor AI-memory packages backdoored on npm and PyPI with 'sckit' credential stealer
The malicious releases went out on 23 September 2026 and were live in the default install path, so any agent gateway, developer workstation or CI runner that installed them this week must be treated as having leaked every credential in its environment before the versions are pulled and the trail goes cold.
Three releases of the npm package @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and the PyPI package MemoryOS 2.0.34 were published with a hidden cross-platform Go implant dubbed 'sckit'. The payload is launched when the AI agent gateway starts and on every memory-recall call, and is handed the host process environment — including any inherited cloud, registry and API credentials — plus the user's prompt text, which it exfiltrates.
Affected: @memtensor/memos-cloud-openclaw-plugin 0.1.21 (npm); @memtensor/memos-cloud-openclaw-plugin 0.1.23 (npm); @memtensor/memos-cloud-openclaw-plugin 0.1.25 (npm); MemoryOS 2.0.34 (PyPI, project quarantined)
How to Test
Grep lockfiles, npm/pip caches and container images for @memtensor/memos-cloud-openclaw-plugin at 0.1.21, 0.1.23 or 0.1.25 and for MemoryOS==2.0.34 (`npm ls @memtensor/memos-cloud-openclaw-plugin`, `pip show memoryos`, search package-lock.json/pnpm-lock.yaml/poetry.lock and CI build logs since 22 Sep 2026); on hosts that match, look for a bundled Go executable dropped alongside the plugin and for a child process spawned by the agent gateway making outbound connections at gateway start and on memory-recall, and review egress logs from those hosts for unexplained destinations.
How to Mitigate
Remove the malicious releases and pin to a known-clean version (0.1.22/0.1.24 are reported clean) or uninstall the plugin and MemoryOS 2.0.34 entirely, rebuild affected runners and workstations from clean images, then rotate every secret that was present in the environment of those processes — cloud keys, npm/PyPI publish tokens, CI/CD and GitHub tokens, model/API keys — and revoke the corresponding OAuth grants.