Hostile 93% javascript Download

@memtensor/memos-cloud-openclaw-plugin 0.1.25

Credential theft, C2, persistence

“OpenClaw lifecycle plugin for MemOS Cloud (add + recall memory)”

Go worm uses harvested credentials to republish repositoriessckit JavaScript dropper launcher source
SHA-256a6870826cd7c7ec8d32af227252efcdcdca03ac956d4702cdc2157ca82641673
URLhttps://registry.npmjs.org/@memtensor/memos-cloud-openclaw-plugin/-/memos-cloud-openclaw-plugin-0.1.25.tgz
MaleculeK₃(McAm₂Te)O₉(LaS₃As₇C₄Ca₃CoEuIP)H₉(Cm₄₂Cr₁₂Db₂₉F₂₀HfOs₁₁Po₁₅TiU₉)Md₈(Bi₄BkIn₁₂Pa₁₀Pt₂Si₂)

Also flagged by https://feeds.feedburner.com/TheHackersNews (Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI), https://safedep.io/rss.xml (MemTensor npm and PyPI Packages Hit by a Go Worm), https://www.stepsecurity.io/blog/rss.xml (Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes), osv (MAL-2026-16476: Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)) +7 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.