First Supply Chain Attack Targeting AI Agent Memory Hits npm and PyPI

On 23 September 2026, between 02.23 and 05.55 UTC, malicious software packages infiltrated the npm and PyPI repositories through MemOS—an open-source memory framework for large language models and AI agents maintained by MemTensor, with around 11,500 stars on GitHub. The payload was a cross-platform Go-based credential stealer named sckit. This is the first supply chain worm to specifically target agent memory infrastructure.

The compromise began with a direct commit to the MemTensor GitHub repository through the maintainer account leason1974 without including gitHead. Clean versions appeared in between malicious versions—0.1.22 and 0.1.24 on npm—which Semgrep researchers read as an attempt by the attacker to test payload optimization while access was still available. Affected versions: npm @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, and 0.1.25; and PyPI MemoryOS 2.0.34.

Sckit does not use a postinstall hook—a mechanism that is now commonly scanned for. Instead, it attaches to functions the agent still calls. On npm, the malicious version added lib/sckit.js, which launches a platform-specific Go binary from the hidden directory .sckit/. The launcher activates at two points: when the OpenClaw agent gateway starts up, and every time the memory-recall hook is triggered. The second trigger is crucial—every recall call sends the user's prompt text to the binary through the environment variable SCKIT_EVENT_TEXT. StepSecurity's analysis asserts that anything a developer typed to the agent while an affected version was loaded must be considered exposed.

On the Python side, the attack is more elegant. A report from The Hacker News says the payload is triggered via memos/log.py, where configure_logging() adds a call to memos._stage0.trigger(). Because Python executes module-level statements on import, merely 'import memos' is enough to reach the logging hook, which then reaches the launcher. No install-time script is needed.

The sckit binary harvests credentials from 13 categories: npm tokens, PyPI tokens, GitHub and GitLab personal access tokens, AWS access keys, Hugging Face tokens, HashiCorp Vault tokens, Slack tokens, live Stripe keys, SendGrid keys, SSH keys, generic JWTs, and environment variables matching secret patterns. Captured data is streamed to command-and-control infrastructure at skyleen[.]fr and its subdomains.

The embedded configuration—decoded from the base64 argument --config64—names the campaign cloud-openclaw-semi-nuclear, sets $HOME as the inventory root, and configures three external fronts with the endpoints /config, /status, and /batch. The campaign's not_after timestamp coincides with 23 October 2026.

The binary includes functions named recursivePublish, prepareRemoteNode, prepareRemotePython, and prepareRemoteWorkflow. The embedded GitHub Actions template requests execution on push. The design is clear: steal publishing tokens, use them to push compromised versions of other packages, repeat.

As of this writing, no downstream propagation has been confirmed. The propagation capability exists in the code; real-world activation has not been documented.

T/I/S coverage this week has tracked agent security across layers: kernel (Muse Sentinel eBPF taint tracking, Post 130742), VM (GrokBot persistent environments), and browser. The MemTensor incident adds the package ecosystem—specifically the memory frameworks agents rely on—to that list.

Three properties make agent stacks a highly profitable target. First, high credential density: agents need access to secrets to function, so the machines running them tend to store publishing tokens, cloud keys, and API credentials. Second, few teams do threat modeling for 'pip install' on AI projects. Third, the prompts themselves carry sensitive data that conventional supply chain attacks never touch.

"The combination of credential access and sensitive prompts makes AI agents an attack vector that security teams do not yet fully understand," said a security researcher who asked not to be named.

For Indonesia, this incident is a stark warning. The wave of generative AI adoption in banking, e-commerce, and public services has led many organizations to integrate intelligent agents into their workflows. Often, development teams here install packages like MemOS or MemoryOS directly from npm and PyPI without checking versions or scanning dependencies. Yet a single credential leaked from a development environment can open the door to internal code repositories, customer databases, and even payment systems. The national cybersecurity authority needs to accelerate outreach on software supply chain security practices, while domestic technology companies should be encouraged to adopt 'pin version' policies and periodic credential rotation.

Recommended mitigation steps: pin npm to version 0.1.20 and PyPI to 2.0.33, or remove the packages entirely. Rotate every credential accessible from any environment that imported an affected version—registry tokens first, then source control, cloud, Vault, and SSH keys. Block skyleen[.]fr and all its subdomains. Search lockfiles, requirements*.txt, poetry.lock, and SBOMs for the affected package names. Audit your own releases if an affected host stored publishing tokens.

Going forward, the big question is no longer whether a supply chain worm will target AI agents, but how quickly the software ecosystem—including in Indonesia—can build defenses that match the speed of the attack. Without concrete steps, the MemTensor incident could become a blueprint for broader attacks in the future.