Malicious versions 0.1.21 and 0.1.23 published to npm — publish token appears compromised

[omeridel]

Summary

Three versions of @memtensor/memos-cloud-openclaw-plugin were published to npm on 2026-09-23 that do not correspond to any commit or tag in this repository. Two of them contain a credential-harvesting payload. 0.1.23 is currently the latest tag, so new installs are receiving it.

We found this through automated supply-chain monitoring and verified it by downloading and diffing the published artifacts. We have not contacted npm on your behalf.

Timeline (UTC)

Version	Published	Unpacked	Files
0.1.20	2026-08-03	271,704	18
0.1.21	2026-09-23 02:23:04	43,654,487	24
0.1.22	2026-09-23 03:45:44	271,704	18
0.1.23	2026-09-23 03:49:20	43,654,622	24

0.1.22 appears to be a revert to clean 0.1.20 content. 0.1.23 re-introduced the payload four minutes later.

Why this looks like a token compromise rather than a repository issue

• sckit does not appear anywhere in this repository
• lib/ at HEAD contains no sckit.js
• The most recent tag is v0.1.20; there are no tags for 0.1.21, 0.1.22 or 0.1.23
• The most recent commit is dated 2026-08-14, six weeks before these publishes

The payload exists only in the npm artifacts. Nothing in your git history changed.

What the added code does

Compared with 0.1.20, the malicious versions add only lib/sckit.js and six platform-specific binaries under .sckit/ (~7.4 MB each, statically linked and stripped). telemetry.credentials.json is removed.

lib/sckit.js spawns the bundled binary detached with stdio: "ignore", passing the full process environment plus the user's prompt text via SCKIT_EVENT_TEXT. It is invoked from index.js at gateway startup (line 717) and on every recall event (line 823). A second function explicitly reads NPM_TOKEN / NODE_AUTH_TOKEN.

A base64 configuration constant decodes to a campaign identifier, three external endpoints, inventory_roots: ["$HOME"], and a persistence directory at $HOME/.openclaw/.cache/runtime.

We have not run the binaries — analysis is static only. We can share full IOCs privately if useful.

Suggested next steps

• Revoke and reissue all npm publish tokens for this package, including any stored in CI
• Ask npm security to unpublish or deprecate 0.1.21 and 0.1.23, and review which account published them
• Consider npm 2FA-required publishing and trusted publishing / provenance so registry artifacts are tied to a repository build
• Advise users who installed 0.1.21 or 0.1.23 to rotate npm tokens and check $HOME/.openclaw/.cache/runtime