Loading story…
Compromised releases of the AI memory-integration package @memtensor/memos-cloud-openclaw-plugin on npm and MemoryOS on PyPI distributed the multiplatform Go-based Sckit worm, also tracked as supplychain.local. Affected npm versions include 0.1.21, 0.1.23, and 0.1.25; the PyPI package was affected from version 2.0.34. The payload executes when affected functionality is invoked—including agent-gateway startup and memory-recall events—rather than during installation, launching detached Windows, Linux, or macOS binaries across x86 and ARM systems. It inherits the host environment and can receive recalled prompts in SCKIT_EVENT_TEXT, potentially exposing credentials and sensitive prompt data available to the process.
The malware is designed to inventory user home directories and steal credentials for cloud providers, source-control services, package registries, AI platforms, and business applications. Its suspected objectives include compromising GitHub repositories and CI environments, planting self-executing GitHub Actions or package hooks, and republishing through npm and PyPI; however, investigators had not confirmed successful exfiltration, propagation, persistence, or public repositories containing its propagation stubs. The rapid alternation of malicious and clean npm releases indicates that the publisher account and release environment may have been compromised. Suspected command-and-control infrastructure includes skyleen.fr domains resolving to 139.84.223.178; version 0.1.25 also added a Linux CA-certificate fallback, likely to improve outbound HTTPS connectivity.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Malicious npm version 0.1.25 was published three minutes and 28 seconds after clean 0.1.24. It retained the same Sckit payload binaries while adding Linux CA-bundle fallback code, likely intended to improve HTTPS connectivity where system trust bundles were unavailable.
A clean version 0.1.24 was released before a further malicious version was published minutes later, reinforcing evidence of unauthorized or otherwise anomalous package publishing activity.
Malicious npm version 0.1.23 was published three minutes and 36 seconds after clean version 0.1.22, using bundled Sckit executables matching those in the other malicious releases.
A clean version 0.1.22 release was published after malicious 0.1.21, beginning an alternating pattern of clean and malicious registry releases. The examined source repository had no corresponding commits or tags for the malicious artifacts.
A threat actor published malicious @memtensor/memos-cloud-openclaw-plugin version 0.1.21 and reportedly compromised the MemoryOS PyPI package from version 2.0.34. The bundled multiplatform Sckit/Go payload executes when affected packages are invoked rather than during installation.
Version 0.1.20 of @memtensor/memos-cloud-openclaw-plugin was published as the clean comparison baseline, before the malicious releases that followed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Miasma** malware family is expanding from software supply-chain compromise into AI-assisted development environments, using trusted tooling to gain persistence, steal credentials, and sabotage systems. Tenable linked the campaign to **Mini Shai-Hulud** and a Miasma variant that modifies AI coding assistant configuration and rules files, adding `SessionStart` hooks and prompt-injection content so malicious actions run automatically when developers launch tools such as **Claude Code, Gemini CLI, GitHub Copilot, Cursor, ChatGPT Codex, Cline, and Aider**. WIRED, citing CrowdStrike research, said the malware is built to burrow into AI infrastructure, exfiltrate sensitive data, deepen access, and in some cases trigger a destructive "death switch" that locks out users while wiping or damaging files. Semgrep separately detailed a related supply-chain intrusion in which an attacker gained push access to the `asyncapi/generator` repository’s `next` branch and used the project’s legitimate GitHub Actions release workflow to publish malicious npm packages with valid **SLSA provenance** through npm’s trusted-publisher integration. Affected packages included **`@asyncapi/generator`**, **`@asyncapi/generator-helpers`**, **`@asyncapi/generator-components`**, and later **`@asyncapi/specs`**; they contained an obfuscated dropper that executed on `require()`, launched a hidden Node.js process, fetched a second-stage payload from **IPFS**, and deployed **Miasma v3**. The malware sought **GitHub, npm, PyPI, AWS, Kubernetes, SSH, browser, and macOS Keychain** secrets, underscoring how attackers are abusing both package ecosystems and AI agent harness files as high-trust, low-visibility footholds in developer environments.
Jul 24, 2026
Microsoft Threat Intelligence warned that version `2.4.6` of the widely used `mistralai` package on PyPI was compromised in a software supply-chain attack, with malicious code inserted into `mistralai/client/__init__.py`. The code executed on import, retrieved a second-stage payload from a remote server, and deployed malware on Linux systems. The payload was written to `/tmp/transformers.pyz` to resemble legitimate Hugging Face tooling, while additional components including `pgmonitor.py` and a persistent `systemd` service named `pgsql-monitor.service` were used to blend into developer and database-monitoring environments. Microsoft said the malware primarily targeted credentials and persistence, with the potential to expose GitHub tokens, cloud API keys, SSH keys, npm credentials, and CI/CD secrets. Researchers said the intrusion may be tied to the broader **Mini Shai-Hulud** campaign, which has also been associated with compromised TanStack packages and multiple Mistral npm SDK packages, suggesting an expanding effort against developer ecosystems and trusted package repositories. The malware also contained geo-aware logic, including a destructive branch that could trigger system wiping on hosts appearing to be in Israel or Iran, while avoiding Russian-language systems. Microsoft urged defenders to isolate affected Linux hosts, block outbound connections to the malicious infrastructure, hunt for indicators including `/tmp/transformers.pyz`, `pgmonitor.py`, and `pgsql-monitor.service`, and rotate any credentials that may have been exposed.
Jun 29, 2026
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026