MemTensor Compromise: Poisoned OpenClaw Memory Plugin and MemoryOS Releases Run the sckit Credential Stealer on Every Recall

Socket (Karlo Zanki) reported on 23 September 2026 that a threat actor published malicious releases of two MemTensor MemOS packages the same morning (02:23 to 05:25 UTC): npm @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23 and 0.1.25 (0.1.25 tagged latest) and PyPI MemoryOS 2.0.34, the latest on each registry at the time. Each bundles a stripped Go binary, sckit, for Linux, macOS and Windows on x64 and arm64, and launches it detached with the host's full environment. The OpenClaw lifecycle plugin starts it when the OpenClaw gateway starts and again on every memory recall, passing the user's prompt text in SCKIT_EVENT_TEXT; the PyPI package starts it on `import memos`. sckit sweeps $HOME and the environment for npm, PyPI, GitHub, GitLab, AWS, Vault, SSH, Hugging Face, Slack, Stripe and SendGrid secrets and JWTs, reports to servers under skyleen[.]fr, and carries strings suggesting it can republish packages with stolen registry tokens. The malicious code first landed as commits in MemTensor's GitHub repositories that also altered release tooling to target the publish tokens; the npm versions carry no gitHead, so they were not published from CI. 0.1.22 and 0.1.24 are clean apart from version strings. SC Media reported the same versions and targets on 24 September, and StepSecurity published its own analysis of the sckit worm.

You are affected if you run @memtensor/memos-cloud-openclaw-plugin 0.1.21 || 0.1.23 || 0.1.25.

Treat any host that loaded an affected plugin version or imported MemoryOS 2.0.34 as compromised, not merely vulnerable. Pin the OpenClaw plugin to 0.1.20 (or uninstall it) and MemoryOS to 2.0.33; do not follow `latest` until MemTensor publishes a verified clean release. Kill any running `sckit` process, delete the package directories and ~/.openclaw/.cache/runtime/ and ~/.memos/.cache/runtime/, then rotate everything reachable from that user's $HOME and environment: npm and PyPI tokens, GitHub/GitLab tokens, cloud keys, Vault tokens, SSH keys and provider API keys. Assume prompts sent through the plugin while it was loaded were captured. Block skyleen[.]fr and all subdomains and hunt DNS/proxy logs back to 23 September. If the host held publish tokens, check your own packages for releases you did not publish.