registry / @memtensor/memos-cloud-openclaw-plugin / 0.1.21

@memtensor/memos-cloud-openclaw-plugin@0.1.21

OpenClaw lifecycle plugin for MemOS Cloud (add + recall memory)

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The OpenClaw plugin entrypoint detaches a bundled native stage0 binary and feeds it a hidden runtime profile plus the process environment. The profile inventories the home directory and contacts skyleen.fr control fronts. This runs when the host gateway starts and again on user recall prompts.

Static reason

No blocking static signals were detected.

Trigger

Plugin register during gateway startup, and each memory recall that reaches launchStageZero with the user prompt.

Impact

A hidden implant can read the user home directory and environment, including tokens such as NPM_TOKEN, send prompt text and results to attacker hosts, and keep state under the OpenClaw cache.

Mechanism

launchStageZero resolves .sckit/<platform>-<arch>/sckit, then spawns it detached as stage0 with a base64 config, stdio ignored, and env copied from process.env plus SCKIT_EVENT_TEXT. The config selects three skyleen.fr fronts and a home-directory inventory.

Attack narrative

When the plugin registers on gateway startup, and again when a recall prompt is handled, index.js launches a detached copy of the bundled sckit binary. The process receives a base64 profile for campaign cloud-openclaw-semi-nuclear, the full environment, and the prompt text. That profile inventories the home directory, stores state in the OpenClaw cache, and points at three skyleen.fr hosts for config, status, and batch exchange. A second helper can demand a credential receipt. This is a hidden implant loader beside the MemOS client.

AI rationale

The plugin silently detaches a native stage0 binary whose embedded profile inventories the home directory, forwards the process environment, and contacts unrelated skyleen.fr control servers. That is concrete remote-controlled payload execution, not ordinary MemOS API use.

Evidence

lib/sckit.jsindex.js.sckit/darwin-amd64/sckit

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs in the background each time the package loads. It collects credentials from the home directory and sends them to servers under skyleen[.]fr. It also includes the code it needs to copy itself into other repositories and packages that the stolen credentials can reach. Credential collection: the implant's `credentialPaths`, `readCredentialFile` and `extractJSONCredentials` functions target `.npmrc`, `.pypirc`, `.git-credentials`, `.netrc`, `id_rsa`, `id_ecdsa`, `id_ed25519`, `.vault-token`, `msal_token_cache`, `access_tokens.json` and `access_tokens.db`. Two regular expressions pick out secrets: one matches secret-like variable names (`token`, `secret`, `password`, `api_key`, `database_url`), the other matches known token formats. C2 protocol: the `internal/wire` package uses CBOR, X25519 key exchange and XChaCha20-Poly1305 (`sckit/xchacha/v1`), and handles signed leases, manifests and modules. The server delivers the modules at run time, so their contents were not observed. `scheduleSelfDelete` and `deleteExecutable` remove the binary after it runs. C2 paths: `/<24 hex>/config` (control), `/status` (preflight), `/batch` (results). Package archive SHA-256 digests: - memos-cloud-openclaw-plugin-0.1.21.tgz: 995a208944176c437a023f4a5c11baad2eb77a91847893c82e5866eaabedb810 - memos-cloud-openclaw-plugin-0.1.23.tgz: 6caf89b059e9b6c82bb4ac4727816d516753c4d26833434dea0ecda44a346eb3 - memos-cloud-openclaw-plugin-0.1.25.tgz: a6870826cd7c7ec8d32af227252efcdcdca03ac956d4702cdc2157ca82641673 --- ## Source: amazon-inspector (1c533046b0b10308e2664ad7b6322eca047056161df3a4977972ccb1ffe3e349) The npm package advertises itself as a memory plugin but bundles a Go-compiled binary at.sckit/<platform>/sckit for six OS/arch targets whose build path is 'supplychain.local/campaign/cmd/implant'. index.js imports lib/sckit.js, whose launchStageZero() detach-spawns the bundled binary as 'stage0 --config64 <b64>' with stdio ignored and unref()'d, so simply loading the plugin runs the implant in the background. The base64 CONFIG constant in lib/sckit.js decodes to a runtime configuration naming campaign_id 'cloud-openclaw-semi-nuclear', inventory_roots ['$HOME'], state_dir '$HOME/.openclaw/.cache/runtime', and three control/preflight/result fronts at 8a8acaf167b3.skyleen.fr, 0b48fafd6fbe.skyleen.fr, and 266297c6df27.skyleen.fr with UUID-shaped /config, /status, /batch paths — destinations that are not present in cleartext anywhere in the JavaScript source. The configuration's 'channel' field is 'exact-ref-one-use-NPM_TOKEN,@memtensor/memos-cloud-openclaw-plugin', and a companion collectStageZero() invokes the same binary synchronously with '--require-credential-receipt', targeting the installer's npm publishing token as it appears in ~/.npmrc or in CI environment variables. The combination of a bundled native implant auto-executed on plugin load, obfuscated hardcoded C2 fronts, whole-$HOME inventory, and explicit NPM_TOKEN capture is credential theft and host exfiltration against the installer, not the plugin functionality the package name advertises. Binary strings such as 'supplychain.local/campaign' and the 'semi-nuclear' profile label suggest a red-team or research framing, but the published artifact acts on installers of a memory plugin rather than on an operator-chosen target, so the offensive-tool framing does not apply. ## Source: ghsa-malware (392fa28fd3caee9373f574a4e84e36f01d87d366eeb463993b189b95416cec62) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@memtensor/memos-cloud-openclaw-plugin@0.1.21

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code