"sckit": A Worm Targeting AI Agent Memory Infrastructure Hits MemTensor's npm and PyPI Packages

MemTensor's MemOS, an open-source memory framework for LLMs and AI agents with roughly 11,500 GitHub stars, through its OpenClaw plugin on npm and its Python package on PyPI

Between 02:23 and 05:55 UTC on September 23, 2026, an attacker published three malicious versions of `@memtensor/memos-cloud-openclaw-plugin` (0.1.21, 0.1.23, 0.1.25) and one malicious version of the MemoryOS package on PyPI (2.0.34), each carrying a cross-platform Go binary named `sckit`. The publish tokens came from MemTensor's own GitHub Actions release pipelines, where the attacker injected commits that exposed them. `sckit` harvests credentials from developer machines and CI jobs, including `NPM_TOKEN`, `PYPI_API_TOKEN`, AWS keys, GitHub and GitLab tokens, SSH keys, and database connection strings, sends them to servers under `skyleen[.]fr`, accepts signed tasks from its C2, and carries templates to install itself into npm packages, Python packages, and GitHub Actions workflows reachable with the stolen credentials. Aikido, SafeDep, Socket, and StepSecurity identified the releases; clean versions are npm 0.1.24 and PyPI 2.0.33. SafeDep and others describe it as the first documented supply chain worm aimed specifically at agent memory infrastructure

Release credentials reachable from the CI pipeline that uses them, on a package that by design sits inside agent runtimes and stores what agents remember. The self-propagation templates turn each victim's tokens into the next set of poisoned releases