sckit Supply Chain — Malicious MemTensor Package Versions in Logs

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

This rule monitors application, build system, and dependency scanning logs for references to known-malicious versions of the @memtensor/memos-cloud-openclaw-plugin (npm) and MemoryOS (PyPI) packages. These versions contain the sckit Go worm and are associated with automated supply chain attacks involving the reuse of stolen credentials, indicated by the 'exact-ref-one-use-NPM_TOKEN' marker.