Skip to content

Back to the catalog

aikido.devwriteup

Novel supplychain.local Go worm appears

Aikido Security reports on a novel worm, apparently written in Go and referencing a "supplychain.local" domain, that spreads via malicious packages published to npm and PyPI under the name memtensor. The page content could not be retrieved, so specifics of the propagation mechanism and payload are unconfirmed beyond the title and URL.

TL;DR Aikido flags a new Go-based npm/PyPI supply-chain worm tied to a package called memtensor.
Open original ↗
Document

What it is

The supplychain.local worm (Aikido's tracking name, taken from the threat actor's Go module name) is a multiplatform Golang self-propagating supply chain worm published 23 September 2026 via two previously-benign, now-compromised packages:

  • npm: @memtensor/memos-cloud-openclaw-plugin versions >=0.1.21
  • PyPI: MemoryOS versions >=2.0.34

Note the compromised npm package is @memtensor/memos-cloud-openclaw-plugin, not a package literally named memtensor — the existing summary's naming is imprecise.

How it works

Each package carries a loader written in the package's own language, wired into top-level application code. It runs on any invocation of the package, not at install time. The loader locates a bundled sckit binary in a hidden .sckit directory (ARM and x86 builds for Windows, Linux, macOS) and executes it as sckit stage0 --config64 <base64 blob>, detached, with stdio ignored.

The base64 config (schema: sckit.runtime.v1) carries a campaign_id, source package identity, a root_public key, a stage0_digest, a state_dir for a state-tracking dropfile ($HOME/.openclaw/.cache/runtime), and a fronts array of C2 base URLs each with config/status/batch paths. It carries a not_after expiry (1792714982).

Propagation is threefold:

  1. GitHub Actions — drops a workflow triggering on [push] that runs ./%s/linux-amd64/sckit stage0 --config64 %q.
  2. postinstall stubs — JS stub dropped to bootstrap.cjs, plus a Python stub, both spawning the local sckit binary.
  3. Direct publishing — npm publish / npm version patch and twine upload using credentials stolen from workstations or CI.

The Go binary hunts secrets via regex: generic JWTs, AWS keys (AKIA/ASIA), GitHub tokens (github_pat_, gh[opusr]_), GitLab (glpat-), npm (npm_), PyPI (pypi-), Hugging Face (hf_), Vault (hvs.), Slack (xox[abprs]-), Stripe (sk_live_), and SendGrid (SG.).

What to do

Block/hunt these IOCs:

Domains (all resolve to 139.84.223.178):

8a8acaf167b3.skyleen.fr
0b48fafd6fbe.skyleen.fr
266297c6df27.skyleen.fr
c747d139e7e9.skyleen.fr
73376a079d87.skyleen.fr
d4f77a3a8cb0.skyleen.fr

sckit binary SHA-256:

65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31
f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce
381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18
e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26
d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26
56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be

Also hunt for a hidden .sckit directory in package trees, a bootstrap.cjs postinstall, and the $HOME/.openclaw/.cache/runtime state file. Rotate any npm/PyPI/GitHub/cloud credentials exposed to CI or workstations that pulled the affected versions.

Caveats

Aikido states the analysis is preliminary. Both packages appear compromised rather than malicious-from-origin. Crucially, they had not found any public GitHub workflow files, bootstrap.cjs stubs, or self-execution scripts in public repos at time of writing — the propagation capability is present in the malware but not yet observed spreading in the wild.

Organisations named here

  • memtensor
  • supplychain.local

Technologies named here

  • npm
  • PyPI
  • Go
  • Aikido Security

Related in Supply Chain