Sckit Campaign Targets MemTensor npm Plugin and MemoryOS 2.0.34 on PyPI

Sep 23, 2026 · Original article ↗

Summary

Static analysis identifies malicious MemTensor npm releases 0.1.21, 0.1.23 and 0.1.25, plus Sckit payloads in MemoryOS 2.0.34. Launch hooks and credential-harvesting indicators are detailed; execution and successful exfiltration were not confirmed.

Key points

The investigation identifies malicious additions in MemTensor plugin versions 0.1.21, 0.1.23 and 0.1.25; the payload reappeared minutes after two releases with clean contents.
The npm plugin launches a detached executable during gateway startup and memory recall. The recall path passes prompt text, and the child inherits the host process environment.
Configuration names the user's home directory as an inventory root, while extracted binary strings match patterns for cloud, source-control, registry and other credentials. Successful collection or transmission was not established.
MemoryOS 2.0.34 source contains an import-reachable logging hook and six platform-specific payloads. The analysis did not install or execute the package or contact its configured endpoints.
A conditional CI helper uses signed metadata and hash-pinned downloads; the article says activation of this path and credential theft were not observed.
The article recommends containment, replacing affected artifacts, revoking accessible credentials and reviewing publishing workflows and network activity.

Article Details

Attack Vectors: Compromised releases of @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, and 0.1.25) add a launcher invoked during gateway startup and memory recall. The recall path passes the user prompt to the child process through SCKIT_EVENT_TEXT.
The npm launcher starts a detached, platform-specific sckit executable with a copy of the parent process environment. The article says this establishes credential exposure potential, but not successful external transmission.
The MemoryOS 2.0.34 Python package contains a launcher reachable through logging initialization during import; it starts a platform-specific child with a copy of the environment. The article does not establish that the launcher ran on a particular host.
Static configuration and binary strings support intended inventory of the home directory and credential collection. The article does not establish which files were read or that credentials were successfully exfiltrated.
A conditional CI helper can download and verify signed metadata and hash-pinned assets, then invoke an emitter. Its bridge is gated on a specific publishing-shell path and GitHub Actions environment; activation was not observed.
Defensive Notes: Contain affected hosts or runners, identify and stop detached sckit processes, and preserve relevant evidence before cleanup.
Remove or quarantine the affected npm releases and MemoryOS 2.0.34; validate replacements from trusted sources and rebuild affected environments.
Revoke credentials accessible to affected processes, prioritizing package-publishing tokens, source-control access, cloud credentials, and secrets available through the environment or home directory.
Review network and process telemetry for the listed infrastructure, executable names, command-line pattern, and relevant execution windows.
Audit package releases, repository changes, workflow modifications, publishing jobs, and service access; review BASH_ENV and CI helper output markers if the publishing path may have been activated.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`0b48fafd6fbe[.]skyleen[.]fr`	Configured external front for the npm sckit runtime; successful communication is not established.
DOMAIN	`10729e014d0e[.]skyleen[.]fr`	Host for the conditional CI delivery helper; activation and successful delivery were not observed.
DOMAIN	`266297c6df27[.]skyleen[.]fr`	Configured external front for the npm sckit runtime; successful communication is not established.
DOMAIN	`73376a079d87[.]skyleen[.]fr`	Configured external front for the MemoryOS sckit runtime; successful communication is not established.
DOMAIN	`8a8acaf167b3[.]skyleen[.]fr`	Configured external front for the npm sckit runtime; successful communication is not established.
DOMAIN	`c747d139e7e9[.]skyleen[.]fr`	Configured external front for the MemoryOS sckit runtime; successful communication is not established.
DOMAIN	`d4f77a3a8cb0[.]skyleen[.]fr`	Configured external front for the MemoryOS sckit runtime; successful communication is not established.
IPV4	`139[.]84[.]223[.]178`	Historical resolution recorded for the three configured npm fronts; the article does not assert current resolution.
SHA256	`16de381deb978744535b10f68fe15165251374b86eef18ffc2c47f61ea673047`	Computed SHA-256 of the MemoryOS windows-amd64 sckit payload.
SHA256	`381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18`	Recorded SHA-256 of the malicious npm linux-amd64 sckit payload.
SHA256	`5405e330507602e803f7dd6f2a9d4555aec8558ab222b51413594a962da6888a`	Computed SHA-256 of the MemoryOS darwin-arm64 sckit payload.
SHA256	`56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be`	Recorded SHA-256 of the malicious npm windows-amd64 sckit payload.
SHA256	`65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31`	Recorded SHA-256 of the malicious npm darwin-amd64 sckit payload.
SHA256	`8f647f17a1934679c4095e21bee2b9bd83e28476603758bc91408a0c8443e3b4`	Computed SHA-256 of the MemoryOS linux-arm64 sckit payload.
SHA256	`9de0d5b0ca184f71f630be5781d134998883a02d5d7bc65aeb9559d8f9efb364`	Computed SHA-256 of the MemoryOS darwin-amd64 sckit payload.
SHA256	`c1b0998347b489582bae7b7f4930f9831d9ef4b6bc150cfd488ee1a43272dd36`	Computed SHA-256 of the MemoryOS linux-amd64 sckit payload; the CI helper pins its emitter to this hash.
SHA256	`d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26`	Recorded SHA-256 of the malicious npm windows-arm64 sckit payload.
SHA256	`e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26`	Recorded SHA-256 of the malicious npm linux-arm64 sckit payload.
SHA256	`f7c4014e284f3d56c452b8b222a287c54f73dc4a40a7e022e765ac8376362947`	Computed SHA-256 of the MemoryOS windows-arm64 sckit payload.
SHA256	`f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce`	Recorded SHA-256 of the malicious npm darwin-arm64 sckit payload.
URL	`hxxps[:]//10729e014d0e[.]skyleen[.]fr/eb57efaa7365698fc1e4decc/initial-ci-v2`	Base URL configured for the conditional CI delivery helper.