MalwarePublished 23 Sep 2026

@memtensor/memos-cloud-openclaw-plugin (npm) · Malicious Code

Affects @memtensor/memos-cloud-openclaw-pluginSource GCVE Database

Malicious package : remove @memtensor/memos-cloud-openclaw-plugin and rotate any secrets on hosts that installed it.

Data as of 24 Sep 2026, 06:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16476

What to do

Remove @memtensor/memos-cloud-openclaw-plugin from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@memtensor/memos-cloud-openclaw-plugin	Affected =0.1.25 =0.1.23 =0.1.21	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Malicious versions of the npm package @memtensor/memos-cloud-openclaw-plugin published on September 23, 2026, contain a Go implant named sckit that runs automatically when the package loads. This implant collects various credential files from the user's home directory and exfiltrates them to attacker-controlled servers. It also has self-propagation capabilities to spread to other repositories and packages accessible with stolen credentials. The implant uses encrypted communication channels and deletes itself after execution. The affected versions are 0.1.21, 0.1.23, and 0.1.25.

Impact

Any system that installs or runs the affected versions of @memtensor/memos-cloud-openclaw-plugin is fully compromised. The implant steals a wide range of credentials and tokens from the user's home directory, potentially exposing npm publishing tokens, SSH keys, Vault tokens, and other sensitive secrets. These credentials are sent to attacker-controlled servers, enabling further compromise and lateral movement. The implant can propagate itself to other repositories and packages accessible with stolen credentials, increasing the scope of compromise. Because the implant runs automatically on package load and deletes itself after execution, detection and remediation are challenging. The compromise affects the integrity and confidentiality of the affected systems and any credentials stored on them.

Defensive guidance

Immediate removal of the affected package versions (0.1.21, 0.1.23, 0.1.25) is necessary. All credentials and secrets stored on the compromised system should be considered exposed and must be rotated immediately from a secure, uncompromised environment. Due to the implant's ability to propagate and persist, a full system compromise should be assumed, and affected systems should be thoroughly audited and potentially rebuilt. Monitoring for unusual network traffic to the specified skyleen.fr domains and related UUID paths may assist in detection. Users should avoid installing or using these malicious package versions.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 06:54 UTC

Technical details

References

Community reviews