AIDEFEND in Action AIA-0095IncidentPublished: Oct 1, 2026
MemTensor sckit Payload in OpenClaw Memory Plugin Releases
StepSecurity found unauthorized @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23 and 0.1.25 releases carrying a bundled native sckit payload. The active launchStageZero path runs on gateway startup or memory recall; the recall call passes the current prompt and inherited process environment to a detached child. Package contents and launcher behavior are confirmed, while successful external exfiltration and autonomous worm propagation are not.
The compromised npm artifacts targeted the OpenClaw memory plugin's runtime hooks. Loading the affected plugin is the shared prerequisite; gateway startup and memory recall are independent opportunities to launch the same native payload. Disabling npm install scripts does not stop these runtime hooks.
Unauthorized npm versions 0.1.21, 0.1.23 and 0.1.25 carry malicious code without matching repository commits or tags.
OpenClaw loads the affected plugin. The examined package has no install, preinstall or postinstall script.
Either lifecycle hook can invoke launchStageZero:
At gateway startup, registration invokes it without a prompt.
On each memory recall, it receives the current user prompt before the later short-prompt check.
Each invocation can spawn the bundled platform-specific executable as a detached child. stageZeroEnvironment copies the parent process environment and adds SCKIT_EVENT_TEXT, empty for startup or holding the recall prompt.
StepSecurity reproduced the active JavaScript path and static payload indicators. The separate collectStageZero helper's NPM_TOKEN mapping is not wired into the reproduced index.js. Successful external transmission, native-binary duplicate suppression and autonomous worm propagation remain unverified.
Gate OpenClaw plugin activation on a signature-verified allowlist that binds each approved plugin's publisher, exact version and SHA-256 digest, and keep plugin code from running until the loader population passes. The three unauthorized @memtensor/memos-cloud-openclaw-plugin releases had no approved digest, so registration and launchStageZero would not have run at gateway startup. This check runs at plugin load, not at npm install, which is why it still applies to a package with no install scripts. OpenClaw's built-in plugins.allow list is id-based, not digest-based, so this is a pre-start admission check the deployer runs over the extensions directory, the host-specific adapter the guidance describes, not a stock OpenClaw setting.
Pin the memory plugin to an exact version and integrity hash in the gateway's lock state and refuse floating ranges and auto-update. With the pin in place, the 0.1.21, 0.1.23 and 0.1.25 bytes are never resolved unless a reviewed lock change admits them, so the malicious releases cannot reach gateway startup through routine reinstalls or redeploys. This applies where the plugin version is managed through a lockfile, such as a packaged gateway image, not to an ad-hoc `openclaw plugins install` on a laptop.
Place the OpenClaw gateway host behind a default-deny egress allowlist that permits only the model provider, the MemOS cloud API and the messaging endpoints the deployment actually uses. Plugins run inside the gateway process and the bundled child inherits the host network, so this host-level control, not a per-plugin sandbox, is what blocks the `skyleen.fr` collection endpoints named in the payload configuration; StepSecurity's own Harden-Runner guidance is the same control.
Remove the three malicious plugin versions from every authoritative source, including lockfiles, internal mirrors and extension directories, rather than only publishing a clean follow-up; deny their digests at admission and verify by digest that no gateway can still load them. Filename absence alone is not enough, because the payload is a bundled platform-specific executable under lib/, not the package name.
Independently inventory every root or long-lived credential reachable by the affected gateway account or detached child, including environment values and readable credential files. Revoke the exact exposed or potentially exposed credential objects at their issuers and verify old-credential denial. The public trace does not prove every credential was read or transmitted. Already-issued JWTs and sessions need a separate AID-E-001.002 revocation review; root-key rotation alone does not close those paths.
For managed package intake, require a verified npm provenance attestation bound to an approved publisher identity, build workflow and exact package digest. A missing repository commit or tag is a review signal, not proof that npm provenance is absent; an attacker with a compromised legitimate build workflow may also produce a valid attestation. This gate is effective only if legitimate MemTensor releases actually publish attestations and the organization rejects unverified updates.
If the OpenClaw plugin is packaged through a managed lockfile and reviewed PR, make each version change pass dependency review before merge. Compare the exact npm tarball with maintainer identity, source and release evidence, and flag new platform-specific executables; reject missing required evidence. An ad-hoc `openclaw plugins install` does not cross that PR gate, and a source tag alone cannot establish the published artifact's integrity.
Use an explicit managed OpenClaw collector to discover the complete deployed plugin-package trees, capture all member digests and reconcile them with authenticated inventory, ownership and scan records. Version strings or a single entry-file hash are not complete package evidence. Keep unreadable or unmeasured roots unresolved and emit the exact affected population to admission or eviction owners; inventory neither authorizes loading nor proves those actions completed.
Move gateway secrets out of plaintext environment and configuration into a managed secret store or platform keychain, and resolve them only when the authorized component needs them. This reduces secrets copied through `stageZeroEnvironment` into the child, but a malicious plugin already running inside the same gateway process may still call credential APIs under that process identity. It also does not protect other files the user can read, such as `~/.aws/credentials` or `~/.npmrc`.
Safe Ephemeral Detonation & Attested Raw Observation Reporting
Medium
Before admission, run the exact plugin bytes in a credential-free, deny-by-default detonation profile covering gateway startup and memory recall. Independently verify process-spawn and network telemetry, complete scenario coverage and teardown; the detached child is a behavioral finding. Reading process.env can occur in memory without a syscall, so observing environment access requires explicit instrumentation and cannot be inferred from generic Falco rules. Unsupported observation remains unresolved; the signed report is evidence for a separate admission gate, not approval.
For issuers with independently verifiable token lifecycle and resource-use telemetry, correlate the exact exposed credential population with unapproved client, resource or scope use and post-revocation requests. Verify AWS/GitHub/provider event fields and coverage before relying on them. Public npm publication metadata cannot identify the exact token, so keep that issuer's token-use coverage unresolved rather than infer it from publisher names. This can establish credential misuse; absence of an alert does not prove no exfiltration.
Terminate the detached sckit child processes and the gateway process generation that loaded an affected version, binding the kill to the exact PID, start time and executable digest rather than a name match, because the launcher spawns with detached: true and every memory recall can start another instance. Removing the package (AID-E-003.003) does not stop a child that is already running.
Place the complete OpenClaw gateway, plugin loader and detached child-process tree inside a verified outer microVM or user-space-kernel boundary, with OS restrictions and no developer-home credentials, host sockets or unrelated credential mounts. This limits the credential-file inventory described in the payload configuration. Enforce the boundary before plugin loading and independently verify every child and mount; isolating only model-requested tools misses lifecycle hooks. Prompts and provider keys deliberately made available inside the same gateway remain exposed, so this is containment, not proof that the package is safe or exfiltration occurred.
What Defenders Should Do Now
Find installations of @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23 and 0.1.25; stop loading them and separately terminate detached child processes. Inventory credentials reachable by the gateway account and revoke the incident-scoped objects whose exposure is confirmed or cannot be ruled out after investigation; the published trace does not prove every credential was exfiltrated.
Require exact version and digest admission for replacements. Require npm provenance only where the legitimate publisher actually produces verifiable attestations; also review the package artifact and new native executables.
Minimize secrets visible to plugins, default-deny outbound connections, and test plugin startup and memory-recall hooks, not only npm installation.
1 additional consideration
Evidence and deployment boundary
The observed malicious package release is an incident, but the supplied artifact trace does not prove which victim secrets, if any, were transmitted.
Recommendation: Find deployments of @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23 and 0.1.25; stop loading those versions, terminate the detached child processes, and treat every credential the gateway user could read, including environment variables and files such as ~/.aws/credentials and ~/.npmrc, as exposed.
Conclusion
AIDEFEND ↗ places controls at managed package intake, exact-digest plugin activation and gateway egress. A provenance attestation helps only when the publisher produces and the defender verifies it; post-incident credential eviction must follow the assets actually exposed or credibly at risk.