Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes

A supply chain attack has compromised specific versions of the @memtensor/memos-cloud-openclaw-plugin npm package (0.1.21, 0.1.23, 0.1.25) and the MemoryOS PyPI package (version 2.0.34). The malicious releases include a hidden launcher that executes a credential-harvesting payload during plugin initialization or import, potentially capturing environment variables, prompts, and secrets. The payload targets developer environments by harvesting credentials for cloud platforms, source control, package registries, and AI services, and exfiltrates data to attacker-controlled domains. The attack includes multiple stages, including a TLS trust fallback, embedded configuration with expiration, and a conditional CI delivery mechanism designed to propagate further compromises.

AI-extracted · verify before operational use