MemTensor MemOS Supply Chain Attack: sckit Triggered by Python Imports and OpenClaw Runtime Hooks
1. Basic Information Original Title: The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise Source: Semgrep Published Date: September 23, 2026 Updated Date: None Severity: critical Severity Basis: Binaries targeting Windows, Linux, and macOS are launched from compromised packages from the legitimate MemOS AI memory framework, scanning for tokens belonging to npm, PyPI, GitHub, cloud…
A critical supply chain attack called "MemTensor MemOS" has been disclosed, affecting the popular MemTensor AI memory framework. Malicious code, known as sckit, was embedded in legitimate npm and PyPI distributions of MemTensor. This executable was triggered during Python imports or OpenClaw execution, allowing the attackers to scan for and exfiltrate credentials from affected systems.
The attack begins when an attacker injects sckit into legitimate MemTensor releases available on npm and PyPI package registries. When the affected Python package is imported, or the OpenClaw gateway is started, the malicious binaries are launched. These binaries target the home directory and tool configurations of the user, seeking out credentials and sensitive information to transmit them to a server at skyleen.fr.
The attack can occur on developer workstations, CI runners, and OpenClaw hosts, granting attackers user-level privileges. Once the sckit payload is successfully executed, it can steal various tokens, including those from GitHub, npm, PyPI, AWS, Slack, and other SaaS services. It can also access SSH keys and collected prompt data.
To detect and mitigate this attack, organizations should look for the sckit binary and associated files, such as memos._stage0, in their systems. They should monitor for heavy file access within the home directory and network traffic directed towards skyleen.fr. Administrators should also verify the origins of tokens used by their organization, as well as any anomalies in CI workflow modifications, package publication, and release provenance.
To protect against this attack, organizations should implement measures such as blocking malicious versions of the MemTensor packages, verifying hashes and provenance against gitHead/tag mappings, using short-lived credentials for developer workstations and CI pipelines, and restricting the execution of untrusted binaries and outbound connections to unapproved domains.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
