Security1 publisher2 min readPublished
A pushed commit pulled MemTensor's npm and PyPI publish tokens out of its own release workflow
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
The Watch · Security desk
What happened
- Unknown actors compromised two legitimate MemTensor packages, one on npm and one on PyPI, to ship sckit, a Go credential stealer built in platform-specific form for Windows, Linux and macOS.
- On npm, versions 0.1.21, 0.1.23 and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin carry the payload, while versions 0.1.22 and 0.1.24 are clean.
- The payload harvests credentials from cloud services, source-code platforms, package registries and developer tools, and exfiltrates them to skyleen[.]fr.
- SafeDep says the attacker took the publish tokens from MemTensor's own GitHub Actions release pipelines by pushing commits that made the workflow hand over the npm or PyPI token.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A CI job that resolved one of the malicious versions should be treated as having leaked whatever secrets were injected for that run. The rotation list is per pipeline, not per workstation.
- constraint A pin to 0.1.24 is clean and a pin one release later is not, so triage has to be done per lockfile entry.
- decision Prompt text left the host alongside the process environment, so responders have to decide how to treat whatever users typed into agents during recall; token rotation does not cover it.
- capability With templates for npm packages, Python packages and GitHub Actions workflows, every token the stealer collects becomes a means to publish the next poisoned release somewhere else.
"It collects credentials from developer machines and from CI jobs," SafeDep said. "It receives signed tasks from a command-and-control (C2) server. It also contains templates to install itself in npm packages, Python packages, and GitHub Actions workflows." [14][15] The reports also describe the implant as able to self-proliferate through GitHub and through direct npm and PyPI publishing. [12]
Nothing about the install looks wrong: the package name, the registry and the publishing pipeline are the project's own. [11] The only signal is the version number, and the malicious versions are scattered through the series. Of the six releases from 0.1.20 to 0.1.25, three carry the payload and the three clean ones sit between them. [3][20]
The recommended npm baseline, 0.1.20, is five releases behind 0.1.25, and on PyPI the baseline 2.0.33 is one release behind 2.0.34. [21] The malicious npm versions were still available for download when the advisories went out; PyPI has quarantined the MemoryOS project. [16][4]
StepSecurity said the npm versions "contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event", and that "The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable." [5][6] Recall happens before the agent processes a prompt, as part of the plugin's ordinary work, and the package declares integration points for the Clawdbot and Moltbot runtimes. [17] The PyPI trigger is cruder: import the memos module and the statically linked Go binary starts, with no agent run required. [7][23]
"This places the plugin inside a process that routinely handles user input and may inherit valuable credentials," StepSecurity said. [18] On a developer workstation, that process runs as a user account that can reach cloud configuration, source repositories, package publishing tokens and application secrets. [19] Socket's target list includes the files .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens, environment variables such as NPM_TOKEN and PYPI_API_TOKEN, and keys for AWS, GitHub, GitLab, Hugging Face, HashiCorp Vault, Slack, Stripe and SendGrid. [9][10]
Whether any package outside MemTensor was published with tokens taken in this compromise was unclear as of the four reports. [13] The reporting does not date the publication of the malicious versions. [22] The advisories recommend pinning to 0.1.20 and 2.0.33, rotating exposed secrets, killing any sckit process, and blocking skyleen[.]fr and all its subdomains. [16]
What to watch
- Whether any package outside MemTensor turns out to have been published with tokens taken in this compromise.
- Whether npm removes 0.1.21, 0.1.23 and 0.1.25 as PyPI quarantined MemoryOS, or leaves them installable.
- Whether the signed-task channel is seen issuing the self-install templates into third-party repositories and workflows.