--- title: MemTensor npm and PyPI hit by "supplychain.local" malware description: A threat actor published a novel supply chain worm called 'supplychain.local' to two packages: npm's @memtensor/memos-cloud-openclaw-plugin (versions >=0.1.21)... canonical: https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MemTensor npm and PyPI hit by "supplychain.local" malware | daily.dev og:description: A threat actor published a novel supply chain worm called 'supplychain.local' to two packages: npm's @memtensor/memos-cloud-openclaw-plugin (versions >=0.1.21)... og:url: https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg og:image: https://api.daily.dev/og/posts/TyTL4PKeG.png og:image:alt: MemTensor npm and PyPI hit by "supplychain.local" malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MemTensor npm and PyPI hit by "supplychain.local" malware **[Aikido Security](https://daily.dev/sources/aikido-security)** · 5 min read · 1 upvotes · 0 comments ## Summary A threat actor published a novel supply chain worm called 'supplychain.local' to two packages: npm's @memtensor/memos-cloud-openclaw-plugin (versions >=0.1.21) and PyPI's MemoryOS (versions >=2.0.34). Both packages had legitimate publishing histories before being compromised. The malware is a multiplatform Go binary that executes on package invocation (not at install time), self-propagates via GitHub Actions and direct npm/PyPI publishing, and steals a wide range of secrets including AWS keys, GitHub tokens, npm tokens, PyPI tokens, Stripe keys, and more. It contains platform-specific binaries for Windows, Linux, and macOS on ARM and x86. Indicators of compromise include six C2 domains under skyleen.fr, one IP address (139.84.223.178), and six binary hashes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What packages are affected by the supplychain.local npm and PyPI worm? The supplychain.local worm affects @memtensor/memos-cloud-openclaw-plugin on npm (versions >=0.1.21) and MemoryOS on PyPI (versions >=2.0.34). Both packages had legitimate publishing histories before being compromised. The malware is a multiplatform Go binary that executes on package invocation, not at install time, and targets Windows, Linux, and macOS on ARM and x86 architectures. _Teams auditing their dependency trees for this worm track emerging supply chain incidents on daily.dev._ ### What secrets does the supplychain.local malware steal? The supplychain.local malware uses a Go regex to search for generic JWTs, AWS access key IDs, GitHub tokens, GitLab tokens, npm access tokens, PyPI API tokens, Hugging Face tokens, HashiCorp Vault service tokens, Slack tokens, Stripe live secret keys, and SendGrid API keys. It also references environment variables for package publishing credentials to enable self-propagation via npm publish and PyPI twine upload. _Developers rotating credentials after a supply chain incident find relevant advisories and tooling discussions on daily.dev._ ### What are the indicators of compromise for the supplychain.local Go worm? Known C2 domains are six subdomains under skyleen.fr (8a8acaf167b3, 0b48fafd6fbe, 266297c6df27, c747d139e7e9, 73376a079d87, d4f77a3a8cb0), all resolving to IP 139.84.223.178. Six sckit binary hashes are published, including 65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31. The malware drops state files to $HOME/.openclaw/.cache/runtime and may inject GitHub Actions workflows. _Security engineers monitoring supply chain threats across ecosystems keep up with disclosures like this on daily.dev._ ## Similar posts on daily.dev - [Another npm supply chain worm hits dev environments](https://daily.dev/posts/another-npm-supply-chain-worm-hits-dev-environments-birdicj09) · The Register · 0 upvotes · 0 comments - [New npm supply-chain attack self-spreads to steal auth tokens](https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4) · BleepingComputer · 122 upvotes · 17 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#golang](https://daily.dev/tags/golang), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MemTensor npm and PyPI hit by \"supplychain.local\" malware","url":"https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg"},"datePublished":"2026-09-23T08:34:56.373Z","dateModified":"2026-09-29T19:52:35.879Z","description":"A threat actor published a novel supply chain worm called 'supplychain.local' to two packages: npm's @memtensor/memos-cloud-openclaw-plugin (versions >=0.1.21)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/782c71c172ee91f80b97525452e00a16?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/782c71c172ee91f80b97525452e00a16?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,golang,malware,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"MemTensor npm and PyPI hit by \"supplychain.local\" malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/memtensor-npm-and-pypi-hit-by-supplychain-local-malware-tytl4pkeg#faq","mainEntity":[{"@type":"Question","name":"What packages are affected by the supplychain.local npm and PyPI worm?","acceptedAnswer":{"@type":"Answer","text":"The supplychain.local worm affects @memtensor/memos-cloud-openclaw-plugin on npm (versions >=0.1.21) and MemoryOS on PyPI (versions >=2.0.34). Both packages had legitimate publishing histories before being compromised. The malware is a multiplatform Go binary that executes on package invocation, not at install time, and targets Windows, Linux, and macOS on ARM and x86 architectures. Teams auditing their dependency trees for this worm track emerging supply chain incidents on daily.dev."}},{"@type":"Question","name":"What secrets does the supplychain.local malware steal?","acceptedAnswer":{"@type":"Answer","text":"The supplychain.local malware uses a Go regex to search for generic JWTs, AWS access key IDs, GitHub tokens, GitLab tokens, npm access tokens, PyPI API tokens, Hugging Face tokens, HashiCorp Vault service tokens, Slack tokens, Stripe live secret keys, and SendGrid API keys. It also references environment variables for package publishing credentials to enable self-propagation via npm publish and PyPI twine upload. Developers rotating credentials after a supply chain incident find relevant advisories and tooling discussions on daily.dev."}},{"@type":"Question","name":"What are the indicators of compromise for the supplychain.local Go worm?","acceptedAnswer":{"@type":"Answer","text":"Known C2 domains are six subdomains under skyleen.fr (8a8acaf167b3, 0b48fafd6fbe, 266297c6df27, c747d139e7e9, 73376a079d87, d4f77a3a8cb0), all resolving to IP 139.84.223.178. Six sckit binary hashes are published, including 65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31. The malware drops state files to $HOME/.openclaw/.cache/runtime and may inject GitHub Actions workflows. Security engineers monitoring supply chain threats across ecosystems keep up with disclosures like this on daily.dev."}}]} ```