AiCybr

MemTensor sckit Attack: Affected OpenClaw and MemoryOS Versions, Cleanup and Credential Rotation

By AiCybr Editorial · Published September 25, 2026

Two legitimate MemTensor packages were compromised on September 23, 2026, delivering a cross-platform credential-stealing implant called sckit. SafeDep identified malicious npm releases of @memtensor/memos-cloud-openclaw-plugin at versions 0.1.21, 0.1.23 and 0.1.25, plus MemoryOS 2.0.34 on PyPI.

The incident is directly relevant to OpenClaw users because MemTensor's own documentation recommends installing its cloud-memory plugin through OpenClaw. SafeDep found that the implant executes when affected package code loads, with no npm or Python install hook required. An installation performed with script-suppression options therefore still requires investigation if an affected version was subsequently loaded.

Operators who ran one of the affected releases should remove it, terminate any sckit process, inspect the documented runtime-state locations, and rotate credentials that were accessible from the user's home directory or the affected process environment. SafeDep recommends 0.1.20 as a conservative plugin pin and MemoryOS 2.0.33 for the Python package while the incident is investigated.

Affected versions

Ecosystem Package Affected releases identified by SafeDep Clean version to pin during investigation
npm / OpenClaw @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, 0.1.25 0.1.20
PyPI MemoryOS 2.0.34 2.0.33

SafeDep also observed clean npm releases 0.1.22 and 0.1.24 published between malicious releases on September 23. Its remediation guidance nevertheless recommends pinning the plugin to 0.1.20. PyPI currently presents 2.0.33 as the latest available MemoryOS release, while the historical 2.0.34 page records its September 23 upload.

The Hacker News reported that the malicious releases were subsequently removed from npm and PyPI and lists 0.1.24 and 2.0.33 as the latest clean releases at the time of its update. For incident response, the conservative 0.1.20 plugin pin follows SafeDep's primary research guidance until operators have independently verified a later build and its provenance.

Why --ignore-scripts was insufficient

This compromise used package runtime behavior instead of a conventional package-manager installation hook. SafeDep reports that the affected OpenClaw plugin starts the bundled implant when the OpenClaw gateway loads it and again during memory recall. In MemoryOS 2.0.34, package initialization paths can start the implant when the Python library loads.

That execution path matters for exposure assessment. A package may have installed with install-time scripts suppressed and still have run the implant later when the application imported or loaded it.

What credentials may have been exposed

SafeDep's static analysis found collection logic targeting developer credentials in the user's home directory and credentials inherited through process environment variables. The documented targets include source-control and package-registry credentials, SSH material, cloud CLI credentials, Vault tokens and other developer secrets.

The appropriate rotation scope depends on the machine and account that loaded the affected package. A developer workstation, CI runner and long-lived OpenClaw host can expose different credential sets. Build the rotation list from credentials present on that system during the exposure window instead of limiting response to npm or PyPI tokens.

Remediation checklist

  1. Identify the installed version. Check OpenClaw plugin state, package manifests and lockfiles for @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23 or 0.1.25. Check Python environments for MemoryOS 2.0.34.
  2. Remove the affected package and pin a clean version. SafeDep recommends plugin 0.1.20 and MemoryOS 2.0.33 during incident response. Rebuild affected environments from known-good dependency state where practical.
  3. Stop sckit if present. Review running processes before cleanup so useful incident evidence can be preserved.
  4. Inspect runtime state. SafeDep identifies $HOME/.openclaw/.cache/runtime and $HOME/.memos/.cache/runtime as campaign state locations. Preserve relevant evidence before deleting malicious state.
  5. Rotate reachable credentials. Replace secrets that were stored under the affected user's home directory or available through the process environment. Prioritize source-control, package-registry, cloud, SSH and CI credentials with write or publication privileges.
  6. Review repositories with write access. SafeDep recommends checking repositories for unexpected runtime-update.yml workflows and .sckit/ directories. Review commits and workflow changes made during the exposure window.
  7. Audit downstream releases. Maintainers whose publication credentials were present on an affected host should review package releases and registry activity for unauthorized publication.

Current scope of the incident

SafeDep's September 23 investigation identified the two MemTensor package names above and reported no other affected @memtensor/* packages in the data it examined. Its campaign tracking notes that self-propagation capability exists in the implant; the evidence set had not observed spread beyond the identified MemTensor packages.

That distinction sets the practical response boundary: inventory the confirmed package/version exposure first, then widen repository and registry review when the affected environment held credentials capable of publishing or pushing code.

How the release pipeline was abused

SafeDep's investigation links the malicious publications to release activity using MemTensor's own GitHub identity and CI publication paths. Its analysis indicates that attacker-controlled changes were able to interact with release workflows and publication credentials. The initial access method for the MemTensor GitHub account remains unconfirmed in the published research.

For maintainers, the incident reinforces controls around release provenance: protected release tags, reviewed release environments, trusted publishing where supported, and restrictions preventing unreviewed commit content from controlling credential-bearing publication jobs.

Bottom line

OpenClaw and MemoryOS users should treat execution of the confirmed malicious releases as a credential-exposure event. The immediate sequence is version inventory, removal and clean pinning, evidence preservation, sckit cleanup, credential rotation, and repository/package-registry review. Users on other MemTensor versions should verify their actual installed artifacts and follow new incident updates; use of MemOS alone is insufficient evidence of exposure.

Sources

Continue reading

Cybersecurity Visa VVAH: How the Agentic Security Harness Finds, Fixes and Validates Vulnerabilities

Visa has expanded its open-source Vulnerability Agentic Harness beyond discovery into remediation and validation. Here is how VVAH works, its backend capabilities, safety controls, and deployment requirements.

Cybersecurity JSONata RCE CVEs: Patch 1.8.8 or 2.2.1 and Audit Untrusted Expressions

Three newly assigned JSONata CVEs can turn attacker-controlled expressions into host code execution. Here is the safe version boundary, exposure model, and operator checklist.

AI OpenClaw 2026.9.4 Guide: Skills, Plugins, Cloud Workers, GPT Image 2.5 and Security

OpenClaw 2026.9.4 adds steerable skill learning from past conversations, unified plugin and skill discovery, reusable cloud workers, GPT Image 2.5 support, terminal questions and expanded command-review controls. This guide covers upgrade requirements, architecture, security and deployment impact.