{
  "id": 9886483,
  "title": "MemTensor MemOS Supply Chain Attack: sckit Triggered by Python Imports and OpenClaw Runtime Hooks",
  "url": "https://urgent.news/2026/09/26/memtensor-memos-supply-chain-attack-sckit-triggered-by-python-imports",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-26T02:13:59.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/memtensor-memos-supply-chain-attack-sckit-triggered-by-python-imports-and-openclaw-runtime-hooks-1nin"
  },
  "original_language": "en",
  "account": "A critical supply chain attack called \"MemTensor MemOS\" has been disclosed, affecting the popular MemTensor AI memory framework. Malicious code, known as sckit, was embedded in legitimate npm and PyPI distributions of MemTensor. This executable was triggered during Python imports or OpenClaw execution, allowing the attackers to scan for and exfiltrate credentials from affected systems.\n\nThe attack begins when an attacker injects sckit into legitimate MemTensor releases available on npm and PyPI package registries. When the affected Python package is imported, or the OpenClaw gateway is started, the malicious binaries are launched. These binaries target the home directory and tool configurations of the user, seeking out credentials and sensitive information to transmit them to a server at skyleen.fr.\n\nThe attack can occur on developer workstations, CI runners, and OpenClaw hosts, granting attackers user-level privileges. Once the sckit payload is successfully executed, it can steal various tokens, including those from GitHub, npm, PyPI, AWS, Slack, and other SaaS services. It can also access SSH keys and collected prompt data.\n\nTo detect and mitigate this attack, organizations should look for the sckit binary and associated files, such as memos._stage0, in their systems. They should monitor for heavy file access within the home directory and network traffic directed towards skyleen.fr. Administrators should also verify the origins of tokens used by their organization, as well as any anomalies in CI workflow modifications, package publication, and release provenance.\n\nTo protect against this attack, organizations should implement measures such as blocking malicious versions of the MemTensor packages, verifying hashes and provenance against gitHead/tag mappings, using short-lived credentials for developer workstations and CI pipelines, and restricting the execution of untrusted binaries and outbound connections to unapproved domains.",
  "summary": "1. Basic Information Original Title: The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise Source: Semgrep Published Date: September 23, 2026 Updated Date: None Severity: critical Severity Basis: Binaries targeting Windows, Linux, and macOS are launched from compromised packages from the legitimate MemOS AI memory framework, scanning for tokens belonging to npm, PyPI, GitHub, cloud…",
  "key_points": [
    "Malicious code sckit embedded in MemTensor npm, PyPI distributions",
    "Attack triggered by Python imports, OpenClaw runtime hooks",
    "Attackers exfiltrate credentials, access SSH keys, SaaS service tokens"
  ],
  "editors_take": "This supply chain attack means organizations must now scrutinize token origins and verify package provenance to prevent attackers from gaining user-level privileges and stealing sensitive information.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}