Three malicious npm versions. One PyPI release. Thirteen credential classes. Zero postinstall hooks.
That's the shape of what Semgrep and StepSecurity published on September 23 — what they're calling the first documented supply-chain worm built specifically to hit AI agent memory infrastructure. The payload ships as sckit. It rode three poisoned releases of a MemOS plugin on npm — 0.1.21, 0.1.23, 0.1.25 — plus a single PyPI release, MemoryOS 2.0.34. The headline number isn't the version count, though. It's the zero.
Because the worm never touched `postinstall`. It didn't need to. And that single design decision tells you more about the next two years of software security than anything else in the report.
I read the writeup twice, then messaged two people on my own infrastructure team. That's the reflex. Exchange leads see the wave before it breaks. Except this one had already broken — it just broke in a place almost nobody was watching.
Context: what MemOS is, and why my own agents were the problem
MemTensor's MemOS is an open-source memory framework — the persistent context layer that lets an AI agent remember what happened last session, last week, last quarter. It distributes through npm as @memtensor/memos-cloud-openclaw-plugin, which tells you the entire business model in one string: open core, cloud service, agent plugin. That plugin binds to OpenClaw, an agent gateway. The Python side ships to PyPI as MemoryOS.
Memory is the moat in this category. More context, better memory, more useful agent, more context. It's a data flywheel with a very short runway.
Here's why I flinched. In March 2025 I dropped $5,000 into beta-testing three autonomous trading agents on a decentralized exchange. I didn't write a line of that code. I managed their social presence and watched them trade, running the whole thing like a live reality show for my readers, publishing daily logs and eating the losses in public. It was the most instructive three months of my career.
And every one of those agents sat on a small VPS with a .env file containing an exchange API key, a DeFi wallet key, an RPC provider token, and a pinned dependency list I never audited. Not once. I ran three autonomous bots holding live capital and I never built a threat model for pip install. Neither did anyone else in my orbit.
That's the actual story here. Not the worm. The fact that there were thousands of us.
Bear markets change the question. Nobody is asking about 400% APY anymore. They're asking whether their node is safe. This is that question, moved one layer down the stack — from your wallet, to your process, to your dependency tree.
Core: the trigger is the innovation, and it's staring at us
Let's do the technical part, because the technical part is where the actual novelty lives.
The old supply-chain playbook is dead: install-hook abuse was the vector everyone built scanners for. postinstall scripts fire on install, and by 2025 every serious SCA tool flagged them. So sckit abandoned the technique entirely.
Instead it planted itself in the function path.
On the npm side, a launcher at lib/sckit.js runs when the OpenClaw gateway starts and — more interesting — on every memory-recall hook. On the Python side, the attacker appended a call into memos/log.py, inside configure_logging(), pointing at memos._stage0.trigger(). That's it. That's the whole trick.
It works because Python executes module-level statements at import time. You don't need an install script. You don't need a build hook. You need a developer to type import memos — and the module body runs, the trigger fires, and the payload wakes up. Every subsequent memory recall re-triggers it.
Sit with how much the attacker had to know. They needed the exact call path. They needed the recall hook timing. They needed to understand how OpenClaw's gateway lifecycle interacts with a logging initializer. That is not opportunistic. That's either an insider or someone who spent weeks reading source.
Three things changed at once, and they compound. Agent hosts are credential-dense by architecture — publish tokens, cloud keys, Vault tokens, provider API keys, all on one box. Threat modeling for AI dependencies is close to nonexistent, because the whole category shipped faster than anyone's security review process. And prompts became assets, carrying strategy, business rules, and proprietary context — a data class no prior supply-chain attack ever had a reason to touch.
What the payload actually wants
The binary is Go, cross-platform, and it goes after thirteen classes of credentials: npm and PyPI publish tokens, GitHub and GitLab personal access tokens, AWS access keys, HashiCorp Vault tokens, Slack tokens, Stripe live keys, SendGrid keys, SSH keys, generic JWTs, and secret-shaped environment variables.
Read that list again and notice what's on it. Hugging Face tokens are a first-class target. Not an afterthought, not a wildcard — a named line item. That's an attack built with AI/ML platforms in the target set from the design stage.
The crypto translation is direct. Publish tokens mean the attacker can push malicious versions of packages you depend on. GitHub PATs mean repo write access across your org. Vault and AWS tokens mean your secrets store and your infrastructure. SSH keys mean lateral movement. Stripe live keys mean money that moves instantly and irreversibly.
Wallet private keys are not on that list. That's the part I keep coming back to. Not because the omission is reassuring — because it reads like scope, not oversight. This round targeted the build and deployment layer. A team that can exfiltrate publish tokens and GitHub PATs out of an agent runtime is one commit away from a wallet drainer, and the marginal lift would be trivial.
Lineage matters here. The 2025 npm worms — Shai-Hulud being the ones people remember — spread by volume, spraying across the long tail of JavaScript packages and harvesting whatever walked into the blast radius. They targeted developers generically. sckit targeted a niche: teams running agent memory. Narrower target, higher value per victim, and a runtime that sits next to publish tokens by design. That's escalation, not repetition.
The prompt leak is the real new asset class
Here's the detail I think is being underweighted everywhere.
Every time the recall hook fires, the malware ships the current prompt text outward, tagged through an environment variable called SCKIT_EVENT_TEXT.
For a chatbot, that's a privacy problem. For an autonomous trading agent, that's something else entirely. Your prompt is your strategy.
It's the position-sizing rule. The risk limit. The entry condition. The list of pairs you're watching and the correlation you're exploiting. If you're running an agent that reads a prompt on every recall cycle — and basically all of them do — then whoever holds that exfiltrated stream holds your alpha in real time, tied to an identifier that tells them exactly which agent they're watching.
Traditional supply-chain attacks never touched this. They wanted secrets, compute, or a foothold. This one is pulling a live feed of your decision logic.
I've written before that most teams treat compliance as a checkbox while leaving the actual runtime wide open. This is that thesis with a body count. The KYC file is pristine. The import statement is unguarded.
The worm genes are real — and the campaign has a clock
The binary contains recursivePublish, prepareRemoteNode, prepareRemotePython, and prepareRemoteWorkflow. It embeds a GitHub Actions template that requests execution on push.
That's a full self-propagation loop: steal a publish token, use it to poison another package, let the CI template do the rest, repeat. Whether that loop has actually activated in the wild is a separate question, and so far nobody has confirmed it. The capability is there. That's what matters for planning.
The campaign scaffolding is more revealing than the payload. A base64 --config64 flag decodes an embedded configuration naming the operation cloud-openclaw-semi-nuclear. $HOME is the enumeration root. Three external endpoints — /config, /status, /batch — provide command and control. And there's a not_after date: October 23, 2026.
A hard expiry date is not how hobbyists write malware. That's a scheduled operation with a defined window, a budget, and someone who intends to stop. The C2 domain, skyleen[.]fr, is now the most valuable artifact in this whole investigation.
The tradecraft has one more tell. Between the three malicious npm versions, the attacker published clean ones — 0.1.22 and 0.1.24. Semgrep reads that as iterative payload testing.
And the npm releases carry no gitHead. That's the detail that should worry your platform team the most. A missing gitHead means the publish didn't come through the normal pipeline — or that the pipeline itself is compromised. A stolen maintainer account is bad. A poisoned build root is worse, because every artifact that root has ever produced is now suspect. We didn't get a statement either way, and that silence is its own signal.
Now consider what your scanners actually look for. Install scripts. Version mismatches. A gitHead that doesn't reconcile. This attack scores zero on all three. No install hook, no mismatch, no valid provenance — and the payload still executes cleanly on the first import. That's the definition of a defense-aware attack: built against the detection rules we already shipped, not the ones we're about to. Static analysis was never going to catch this. Runtime behavior monitoring was, and almost nobody runs it on their agent host.
Here's the thing that keeps nagging me. The industry spent two years arguing about modular data availability — whether rollups need dedicated DA layers. My read hasn't changed: the overwhelming majority of rollups never generate enough data to justify one. Meanwhile every one of them runs a logging function on an import path that nobody audits. The availability problem was never the layer. It was the modules.
What to actually do before Friday
The reported remediation is blunt: pin to npm 0.1.20 or PyPI 2.0.33, or remove the dependency outright. No patched version was named. That's not a fix, that's a rollback — and it means the install base is bleeding while the vendor works.
If you run agents in production, the sequence is not optional. Pin or purge. Then rotate every credential in that thirteen-class list, from a machine that was never exposed, starting with publish tokens and PATs. Block the C2 domain at the DNS layer. Grep every lockfile and SBOM you own for the affected versions and for anything downstream that depended on them.
And then do the thing nobody does. Write down which of those credentials your agent runtime can actually reach — and delete the rest. Least privilege is not a compliance artifact. It's the only control that would have shrunk this blast radius from thirteen credential classes to one.
The contrarian read: this isn't a code story
The "first" claim is doing a lot of heavy lifting, and I'd push back on it. The technique is recombination. Worms have propagated through package registries since 2025. Module-level import execution is a language semantic, not an exploit. Legitimate first: a supply-chain worm aimed at agent memory. Overreach: the implication that nothing like this existed before.
The label isn't the point. What's the point is that the framing is wrong.
Everyone is treating this as a vulnerability story — a bad package, a bad version, a patch that's coming. It isn't. This is a custody story wearing a code costume. The memory layer was the delivery vehicle. The prize was identity: the tokens that let you publish, deploy, commit, pay, and authenticate. Memory infrastructure just happened to be where the keys live.
Which brings me to the uncomfortable part. This entire category sits on incentive structures that subsidize exactly the wrong behavior. Liquidity mining taught us the lesson and we keep re-learning it: turn off the rewards and the TVL evaporates, because the TVL was never users. The same dynamic is now playing out in agent infrastructure — growth subsidized by grants and points programs, security paid for with goodwill and a README badge. Subsidized adoption is unearned trust. Unearned trust is what sckit fed on.
We didn't lose this one at the import path. We lost it three quarters earlier, when every team in this space decided a compliance PDF was a substitute for threat-modeling a dependency install.
Regulation doesn't move at wire speed. The attackers do.
Speed isn't the pulse of the market. Trust is.
From chaos to clarity: tracking the blast radius
What I'm watching, in order: MemTensor's official advisory and a real fixed version. Any confirmed downstream contamination — that's the difference between an incident and an outbreak. Threat-intel on the skyleen[.]fr infrastructure, which is where attribution either lands or dies. Whether CISA, ENISA, or CNNVD open a notice, which would pull enterprise procurement into the conversation immediately. Whether OpenClaw tightens plugin review, and whether registry-level provenance enforcement stops being optional.
And one more. Whether "AI-BOM" — a software bill of materials for the agent stack — shows up in enterprise security questionnaires by Q1. I think it does. I think that's the real product of this week, and I think it's being built right now by whoever moved fastest.
The question isn't whether the packages get cleaned up. They will. The question is whether your agent still holds thirteen keys it never needed in the first place.