Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | sckit Go binary |
| Threat Actor | Unknown |
| Target Victims | AI developers and LLM researchers |
| Delivery Vector | Malicious npm and PyPI package releases |
| Key Capabilities | Credential harvesting, background execution, environment scanning |
| Source | Socket |
Executive Summary
A severe software supply chain attack hit the popular open-source AI memory framework MemOS. The MemTensor MemOS compromise distributed credential-stealing malware to artificial intelligence developers. Attackers published malicious package versions to public registries, exposing sensitive tokens and keys.
Delivery
The attack began when unknown individuals compromised MemTensor’s source code repositories. Specifically, the primary MemOS GitHub repository holds about 11,500 stars and 1,100 forks. Subsequently, the threat actor published malicious releases of two packages across different registries. On September 23, 2026, malicious versions of the npm package @memtensor/memos-cloud-openclaw-plugin went live. On the same day, attackers published a compromised version of the PyPI package MemoryOS.
Interestingly, the npm releases originated from an existing maintainer’s account. However, the uploads bypassed standard continuous integration workflows. Currently, Socket researchers could not confirm how the attacker gained publishing access. Therefore, attribution to a specific threat actor remains unconfirmed.
Infection Chain
The malicious packages trigger the payload at different points. First, the npm plugin initiates the malware when the OpenClaw gateway starts. Then, it executes the payload again upon every memory recall operation. Meanwhile, the PyPI package activates the malicious code immediately when a user imports the module.
Ultimately, both packages deploy a cross-platform Go binary named sckit. Specifically, the attackers compiled this binary for Linux, macOS, and Windows environments. Next, the host executes the binary in the background. The process runs detached from the main application. Moreover, it receives a copy of the host’s full environment variables. Consequently, the system discards any execution errors to maintain stealth.
Command-and-Control and Data Exfiltration
Once running, the sckit binary performs extensive reconnaissance. Specifically, it searches the user’s home directory for valuable developer secrets. Next, the malware hunts for credentials related to npm, PyPI, GitHub, GitLab, and AWS. Furthermore, it targets HashiCorp Vault tokens, SSH keys, Hugging Face credentials, and JSON Web Tokens.
Then, the malware transmits these stolen secrets to external command-and-control servers. Specifically, the threat actor configured the malware to report to specific subdomains under skyleen[.]fr. These endpoints process configuration requests, status updates, and batch results.
Interestingly, the binaries contain strings regarding package manifest encoding. This detail suggests the malware might possess the capability to republish packages using stolen registry tokens. Such behavior indicates a potential worm-like spreading mechanism.
Defense and Detection Guidance
Therefore, organizations must treat any host that loaded the affected packages as compromised. Users must immediately remove the malicious versions from their environments. Administrators should pin npm to version 0.1.20 and PyPI to version 2.0.33.
Consequently, developers must rotate all secrets reachable from the affected user environments. This rotation includes cloud provider keys, registry tokens, and communication service API keys. Next, users should terminate any running sckit processes on their machines. They must delete the specific .openclaw and .memos runtime cache directories.
Furthermore, network defenders need to block the skyleen[.]fr domain and all associated subdomains. Security teams should review proxy logs for connections starting September 23, 2026. Additionally, maintainers holding registry publish tokens should verify recent package releases. Prompt mitigation will prevent further credential abuse across the software ecosystem.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
