Build1 publisher2 min readPublished Updated
Compromised MemOS packages scan for developer tokens the moment Python imports them
Semgrep found sckit hidden in the genuine MemOS npm and PyPI packages, where it fires on Python import to scan for npm, GitHub, cloud and Slack tokens. It runs on import, not on install, so install-time scanning misses it, and anyone who imported an affected version should rotate those tokens.
The Engineer · Build desk
What happened
- Semgrep reported on September 23 that malicious code called sckit was embedded in the legitimate MemTensor MemOS packages distributed through npm and PyPI, and rated the compromise critical.
- The payload does not run during installation; it fires when the affected Python package is imported, when the OpenClaw gateway starts, or when a memory-recall hook is invoked.
- Once triggered, platform-specific binaries for Windows, Linux and macOS scan the home directory and tool configs for npm, PyPI, GitHub, cloud and Slack tokens and SSH keys, and send them to skyleen.fr.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Supply-chain checks that watch the install step have nothing to catch here, so a clean install log is no evidence the code stayed dormant.
- exposure Because it runs with the user's privileges, an infected CI runner exposes every token that runner could already read.
- precedent Stolen registry and repo credentials make publishing malicious releases the plausible next step, extending the compromise beyond the first host.
The danger is that import is not a rare event. A Python process imports its dependencies every time it starts; installation happens once. Much supply-chain scanning watches the install step: postinstall hooks, setup scripts, the calls a package makes when it lands. sckit makes none of them at install. [2] Semgrep's writeup states that installation shows no noticeable activity and that successful installation alone does not guarantee safety. [8]
The OpenClaw gateway and the memory-recall hook widen the trigger surface further. The payload also fires during ordinary agent operation. A developer importing the module by hand is only one of its triggers. [2]
If you pulled an affected MemOS version and imported it, or ran OpenClaw against it, rotate what the payload reads: npm, PyPI, GitHub, cloud and Slack tokens, and any SSH keys reachable from the account that ran it. [5] Semgrep's guidance also lists verifying where GitHub, npm, PyPI, AWS and Slack tokens have been used [15], alongside short-lived credentials, blocking the malicious versions, and restricting untrusted binaries and outbound connections. [14] Execution runs with user privileges on workstations, CI runners and OpenClaw hosts, so the reach is whatever those accounts could already read. [9]
Semgrep's analysis describes what the code is built to do. Per-victim theft counts have not been disclosed, and while sckit carries self-propagation code, its spread to public repositories has not been confirmed. [10] Depending on the privileges of the stolen credentials, the analysis says, the theft could lead to secondary compromise of repositories or releases. [12] Semgrep titled its analysis "The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise." [13]
What to watch
- Whether sckit's self-propagation code is confirmed to have spread to public npm or PyPI packages.
- Any disclosure of affected MemOS version numbers or per-victim theft counts.
- Evidence that stolen registry tokens were used to push malicious releases, the secondary path Semgrep flags.