The First Supply Chain Worm to Target AI Agent Memory: Inside the MemOS npm and PyPI Compromise

MemTensor's MemOS is an open source memory framework that gives LLM based agents persistent recall across sessions, the kind of component that sits quietly underneath an agent's conversational layer and almost never gets a second look during a security review. Between 02:23 and 05:55 UTC on September 23, 2026, that quiet assumption broke. Three versions of the npm package @memtensor/memos-cloud-openclaw-plugin, specifically 0.1.21, 0.1.23, and 0.1.25, along with PyPI version 2.0.34 of the companion MemoryOS package, shipped carrying a cross platform, Go based credential stealer that researchers have named sckit. It is the first publicly documented worm built specifically to ride inside AI agent memory infrastructure rather than inside a build tool or a general purpose dependency.

What makes this different from a typical npm compromise

Most npm supply chain compromises, including the node ipc and node gyp incidents security teams are already familiar with, rely on a postinstall script that fires the moment the package is installed. That pattern is loud enough that automated scanning tools increasingly catch it before it reaches production. sckit does not use a postinstall hook at all. Instead, it embeds itself inside code paths that only execute once the package is actually in use:

Package ecosystem	Trigger mechanism	File
npm	Fires when the OpenClaw agent gateway starts, and again every time the memory recall hook activates	lib/sckit.js
PyPI	Triggers through the logging configuration during module import	memos/log.py

That design choice matters because it means a standard install time scan, one that checks for suspicious behavior during npm install or pip install, will not catch this. The malicious behavior only activates once the agent is actually running and actually recalling memory, which is precisely the point: it is designed to survive the install time scrutiny that catches most supply chain attacks.

What sckit actually captures

Once active, sckit captures anything a developer asks the agent while an affected version is loaded, passed through environment variables, and it specifically targets thirteen categories of credentials: npm and PyPI registry tokens, GitHub and GitLab personal access tokens, AWS keys, Hugging Face tokens, HashiCorp Vault credentials, Slack, Stripe, and SendGrid tokens, SSH keys, JWTs, and any environment variable matching common secret naming patterns. That list is not random. It is the exact set of credentials a developer working inside an AI coding agent's environment would plausibly have sitting in local environment variables, which means the attacker built this payload specifically for the AI agent developer's environment rather than adapting a generic credential stealer.

Why targeting agent memory is a meaningfully different attack surface

A traditional dependency compromise targets code that runs once, at build or install time. Agent memory infrastructure is different: it is designed to be read from and written to continuously, across every interaction the agent has, for as long as the session or the persistent memory store exists. A malicious package embedded in that path does not get one shot at exfiltrating data during install. It gets a standing foothold that reactivates every single time the agent recalls something from memory, for as long as the compromised version stays installed. That is a fundamentally more durable compromise than a one time postinstall script, and it is the specific reason this incident is being described as a worm rather than a conventional malicious package.

We covered a related but mechanically different supply chain incident in our post on the mini Shai Hulud TanStack npm and PyPI attack, and the comparison is instructive. That attack and this one both targeted the npm and PyPI ecosystems that AI agent tooling increasingly depends on, but the propagation mechanism here, hiding inside a memory recall hook rather than a build step, is new, and it suggests attackers are specifically studying how agent frameworks are architected rather than reusing a generic supply chain playbook.

What to do if you may be exposed

If your stack uses MemTensor's MemOS or the OpenClaw agent gateway plugin, check your lockfiles and software bill of materials for the affected versions immediately:

npm: @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25
pip: MemoryOS version 2.0.34

If you find any of these versions anywhere in your dependency tree, including transitive dependencies, the recommended response is direct: downgrade to npm version 0.1.20 or PyPI version 2.0.33, rotate every credential accessible from the affected environment starting with registry tokens, block the command and control domain skyleen[.]fr at your network egress layer, and audit your lockfiles and SBOMs across all projects, not just the one where you first found it, since a shared internal package or a monorepo can spread a compromised dependency further than a single project's lockfile shows. As of publication, researchers have not documented downstream propagation beyond the initial compromised versions, but that status can change, and it is not a reason to delay rotation if you find the affected versions anywhere in your environment.

When this applies to your stack

Any team running AI coding agents, agent gateways, or MCP connected tooling should treat agent memory and agent infrastructure packages with the same scrutiny as a production dependency, not as an internal convenience layer that gets a lighter review. Contra Collective's AI integration and agent engineering work includes dependency and supply chain review for exactly this class of infrastructure as part of standing up a secure agentic stack, because the install time scan most teams already run would not have caught this one.

FAQ

Which specific package versions were compromised? npm versions 0.1.21, 0.1.23, and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin, and PyPI version 2.0.34 of MemoryOS. Versions before and after this range, specifically npm 0.1.20 and PyPI 2.0.33, are the documented safe downgrade targets.

How is this different from a typical malicious npm package? Most malicious packages use a postinstall script that fires once, at install time, which automated scanning increasingly catches. sckit instead embeds itself inside the memory recall code path, meaning it only activates once the agent is actually running and recalling memory, bypassing install time detection and reactivating on every memory lookup rather than firing once.

What credentials does sckit target? Thirteen categories, including npm and PyPI tokens, GitHub and GitLab personal access tokens, AWS keys, Hugging Face tokens, HashiCorp Vault credentials, Slack, Stripe, and SendGrid tokens, SSH keys, JWTs, and environment variables matching common secret naming patterns.

Has this worm spread beyond the originally compromised packages? As of publication, researchers have not documented downstream propagation beyond the four originally compromised package versions. That status is current as of the sources available at the time of writing and should be verified against current advisories before assuming it still holds.