--- title: MemTensor npm and PyPI packages backdoored with... description: Two packages linked to MemOS, an open source LLM memory framework with ~11,500 GitHub stars, were backdoored with a supply chain worm called... canonical: https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MemTensor npm and PyPI packages backdoored with credential-stealing supply chain worm | daily.dev og:description: Two packages linked to MemOS, an open source LLM memory framework with ~11,500 GitHub stars, were backdoored with a supply chain worm called... og:url: https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy og:image: https://api.daily.dev/og/posts/Qjo3pkyiy.png og:image:alt: MemTensor npm and PyPI packages backdoored with credential-stealing supply chain worm og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MemTensor npm and PyPI packages backdoored with credential-stealing supply chain worm **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Two packages linked to MemOS, an open source LLM memory framework with ~11,500 GitHub stars, were backdoored with a supply chain worm called `supplychain.local`. The affected packages are `@memtensor/memos-cloud-openclaw-plugin` on npm (versions >= 0.1.21) and `MemoryOS` on PyPI (versions >= 2.0.34), both currently the latest available versions. The payload is a cross-platform Go binary that executes on invocation (not at install time), scans developer home directories, and exfiltrates AWS keys, GitHub tokens, npm tokens, PyPI tokens, and Stripe keys to attacker-controlled C2 servers under `skyleen[.]fr`. The worm self-propagates by publishing to npm and PyPI and spreading via GitHub Actions. Developers with either package installed should immediately rotate all credentials and audit recent GitHub Actions runs. ## Content Malicious releases of MemTensor's MemOS packages showed up on both npm and PyPI. Socket, SC Media and several newsletters flagged the incident. It appears to be a self-propagating worm, and the packages it hit had legitimate publishing histories before the compromise. ## What was compromised - **npm:** `@memtensor/memos-cloud-openclaw-plugin`. Versions 0.1.21, 0.1.23 and 0.1.25 are malicious. One report says three malicious releases; another describes affected versions as >=0.1.21. - **PyPI:** `MemoryOS`, version 2.0.34 (some reports say >=2.0.34). Each malicious release is currently the latest available. MemOS is an open source memory framework for LLMs and AI agents, with roughly 11,500 GitHub stars and 1,100 forks. A lot of people could have pulled these versions without thinking twice. Socket's write-up also notes that malicious versions reappeared within minutes of clean republishes. Whoever is behind this still had publish access, and cleaning up once isn't enough. ## How the malware works The payload is a multiplatform Go implant, dubbed `sckit` or `supplychain.local` depending on the source. It bundles six binaries covering Windows, Linux and macOS on both ARM and x86. It doesn't run at install time. It triggers on package invocation. In the npm plugin that means AI agent gateway startup and memory-recall events, so it also captures the host environment and the user's prompt text. That prompt exposure is easy to overlook when you're only thinking about API keys. It goes after a wide range of secrets: - AWS keys - GitHub tokens - npm and PyPI tokens - Stripe keys - other cloud, source-code platform and developer-tool credentials The binaries scan developer home directories and send what they find to the domain skyleen[.]fr. Version 0.1.25 added a CA certificate bundle so outbound HTTPS keeps working in minimal Linux containers, which shows the author was testing against real deployment environments. The worm part is what makes this ugly. It self-propagates through GitHub Actions and by publishing directly to npm and PyPI with whatever tokens it steals. Socket also points to possible spread through the MemoryOS PyPI package, though that link was not independently confirmed. ## Indicators of compromise - Six C2 domains under `skyleen.fr`. Three subdomains were seen in the npm analysis, all resolving to one IP. - IP address: `139.84.223.178` - Six binary hashes, one per platform/architecture combination ## What to do Treat any machine or CI runner that installed or ran these versions as compromised. 1. **Contain.** Downgrade or remove the affected versions, and isolate hosts where the packages were invoked. 2. **Rotate everything reachable.** Revoke and reissue every credential the process could see: cloud keys, GitHub, npm and PyPI tokens, Stripe keys and anything else in the environment or home directory. 3. **Review prompt exposure.** The npm plugin captures user prompt text, so work out what sensitive content went through affected agents. 4. **Check your pipelines.** Audit GitHub Actions workflows and publishing configuration for unexpected changes. If you publish packages of your own, look for releases you didn't make. 5. **Block the IOCs.** Add the skyleen[.]fr domains and the IP to network blocklists and hunt for past connections. ## Questions this post answers ### Which versions of the MemoryOS PyPI package and @memtensor/memos-cloud-openclaw-plugin npm package are compromised? The compromised versions are `MemoryOS` on PyPI at versions >= 2.0.34 (one malicious release) and `@memtensor/memos-cloud-openclaw-plugin` on npm at versions >= 0.1.21 (three malicious releases). Both are currently the latest versions on their respective registries, meaning developers who installed the latest version are affected. _Developers tracking compromised package versions in their dependency trees find security advisories like this faster on daily.dev._ ### What credentials does the supplychain.local worm steal and how does it spread? The worm targets AWS keys, GitHub tokens, npm tokens, PyPI tokens, and Stripe keys by scanning developer home directories. It spreads by self-publishing to npm and PyPI using stolen tokens and by hijacking GitHub Actions workflows. The payload is a cross-platform Go binary for Windows, Linux, and macOS (ARM and x86) that triggers on package invocation rather than at install time, evading install-time scanners. _Supply chain attacks targeting developer credentials are tracked as they break on daily.dev._ ### What are the indicators of compromise for the MemTensor supply chain worm? The known indicators include six C2 domains under `skyleen[.]fr`, one IP address `139.84.223.178`, and six binary hashes available in the original security advisory. If either package is installed, credentials in the home directory should be rotated immediately and recent GitHub Actions runs should be audited for unexpected publishing activity. _Developers responding to active supply chain incidents use daily.dev to follow the latest advisories and remediation guidance._ ## Similar posts on daily.dev - [Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm](https://daily.dev/posts/red-hat-npm-packages-compromised-to-spread-a-credential-stealing-worm-if43c4tvr) · Aikido Security · 0 upvotes · 0 comments - [Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm](https://daily.dev/posts/red-hat-npm-packages-compromised-in-supply-chain-attack-spreading-credential-stealing-worm-q3mbz24yd) · Orca Security Blog · 0 upvotes · 0 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MemTensor npm and PyPI packages backdoored with credential-stealing supply chain worm","url":"https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy"},"datePublished":"2026-09-23T09:50:33.927Z","dateModified":"2026-09-29T19:52:35.923Z","description":"Two packages linked to MemOS, an open source LLM memory framework with ~11,500 GitHub stars, were backdoored with a supply chain worm called...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1532443a7f98fc6620f618345faa6661?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1532443a7f98fc6620f618345faa6661?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"MemTensor npm and PyPI packages backdoored with credential-stealing supply chain worm"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/memtensor-npm-and-pypi-packages-backdoored-with-credential-stealing-supply-chain-worm-qjo3pkyiy#faq","mainEntity":[{"@type":"Question","name":"Which versions of the MemoryOS PyPI package and @memtensor/memos-cloud-openclaw-plugin npm package are compromised?","acceptedAnswer":{"@type":"Answer","text":"The compromised versions are `MemoryOS` on PyPI at versions >= 2.0.34 (one malicious release) and `@memtensor/memos-cloud-openclaw-plugin` on npm at versions >= 0.1.21 (three malicious releases). Both are currently the latest versions on their respective registries, meaning developers who installed the latest version are affected. Developers tracking compromised package versions in their dependency trees find security advisories like this faster on daily.dev."}},{"@type":"Question","name":"What credentials does the supplychain.local worm steal and how does it spread?","acceptedAnswer":{"@type":"Answer","text":"The worm targets AWS keys, GitHub tokens, npm tokens, PyPI tokens, and Stripe keys by scanning developer home directories. It spreads by self-publishing to npm and PyPI using stolen tokens and by hijacking GitHub Actions workflows. The payload is a cross-platform Go binary for Windows, Linux, and macOS (ARM and x86) that triggers on package invocation rather than at install time, evading install-time scanners. Supply chain attacks targeting developer credentials are tracked as they break on daily.dev."}},{"@type":"Question","name":"What are the indicators of compromise for the MemTensor supply chain worm?","acceptedAnswer":{"@type":"Answer","text":"The known indicators include six C2 domains under `skyleen[.]fr`, one IP address `139.84.223.178`, and six binary hashes available in the original security advisory. If either package is installed, credentials in the home directory should be rotated immediately and recent GitHub Actions runs should be audited for unexpected publishing activity. Developers responding to active supply chain incidents use daily.dev to follow the latest advisories and remediation guidance."}}]} ```