The offending line is almost boring. A single call — memos._stage0.trigger() — appended to configure_logging() inside a Python package's logging initializer. No postinstall script for a scanner to flag. No obfuscated blob in the metadata. Just a function call, waiting patiently for someone to type import memos.
That was the entry point for what the npm and PyPI ecosystems are calling the first recorded supply-chain worm aimed specifically at AI agent memory infrastructure. Across npm versions 0.1.21, 0.1.23 and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin, plus PyPI's MemoryOS 2.0.34, an attacker drove a working credential-theft and self-propagation payload into the memory layer sitting beneath an agent gateway called OpenClaw. Semgrep and StepSecurity published the teardown. The campaign named itself cloud-openclaw-semi-nuclear. Its configuration carried an expiry: not_after 2026-10-23.
An expiry date is the tell. Opportunists do not set calendars.
Crypto has a long, selectively amnesiac relationship with software supply chains. In 2018 it was event-stream, a dependency nobody read. In 2022 it was Ledger Connect Kit, which pushed malicious code into hardware wallet front-ends through a hijacked npm dependency, and taught a generation of hardware wallet owners that their keys were safe and their build pipelines were not. In 2023 a wave of PyPI packages quietly drained wallets at install time. In 2025 the Shai-Hulud npm worm moved through publish tokens the way a fire moves through dry grass.
Every one of those incidents targeted money or the tools that move money. This one targets memory — the layer where an agent stores what it has learned about you, your counterparties, your risk appetite, your signing rules.
Memory frameworks have become a quiet competitive sector: MemOS by MemTensor, Mem0, Zep, Letta, Cognee. The commercial pattern is uniform. Open core, cloud service, plugin distributed through an agent gateway. The value proposition is the data flywheel — the longer you use it, the more context it accumulates, the more useful it becomes. That flywheel is also, structurally, the most expensive thing in the building to move.
In a bull market nobody audits the flywheel. They audit the yield.
What makes sckit technically interesting is not the payload. It is the door it refused to use. The attacker deliberately abandoned the postinstall hook, that ancient and well-scanned vector, and instead planted two runtime function paths. On the npm side, a launcher at lib/sckit.js that fires when the OpenClaw gateway boots and again on every memory-recall hook. On the Python side, a call appended inside memos/log.py, exploiting the fact that Python executes module-level statements at import time. No installation script required. The attacker did not pick the lock. They moved into the room the lock was protecting, and waited.
The binary itself is a Go-compiled cross-platform payload hunting thirteen classes of credential: npm and PyPI tokens, GitHub and GitLab personal access tokens, AWS access keys, HashiCorp Vault tokens, Slack tokens, Stripe live keys, SendGrid keys, SSH keys, generic JWTs, and secret-shaped environment variables. That Hugging Face tokens appear on the list is the clearest evidence yet that AI platform assets are now treated as first-class loot rather than incidental discovery.
The propagation machinery is where the worm earns its name. Functions labelled recursivePublish, prepareRemoteNode, prepareRemotePython and prepareRemoteWorkflow, together with an embedded GitHub Actions template that executes on push, form a closed loop: steal a publish token, use it to contaminate another package, repeat. Nobody has yet confirmed real-world downstream activation. The design, however, is not ambiguous about intent.
Then there is SCKIT_EVENT_TEXT. On every memory recall, the payload exfiltrates the current prompt text.
Read that again with a crypto-specific eye. In a trading agent, the prompt is the strategy — entry conditions, sizing logic, the discretion left to the model. In a treasury agent, the prompt is the signing policy: the counterparty whitelist, the spend ceiling, the escalation path when a transfer looks wrong. A stolen AWS key is a bad afternoon. A stolen prompt is the blueprint of how your capital decides.
One more detail deserves institutional attention. The npm publishes carried no gitHead. Standard CI/CD pipelines attach it. Its absence points either to a bypassed pipeline or to a compromised one — which is materially worse than a phished maintainer account, because it means the trust root of the build system itself was reachable. And sandwiched between malicious versions sit clean ones: 0.1.22 and 0.1.24. That pattern reads as an operator testing payload refinements while holding publishing access.
I have seen this shape before. In 2017, auditing a The DAO successor called Project Aether in Zurich, I found a reentrancy path involving 500 ETH and wrote it up. The frontend team rejected the report as too academic. The lesson was not that the bug was subtle. It was that technical correctness is worthless if the narrative of trust is already broken elsewhere. Three years later in Singapore I modelled ten thousand on-chain transactions and published a paper arguing that token incentives would centralise governance. It was cited, then ignored until the crash. I stopped predicting after that. I started explaining.
So let me explain what this event actually is, stripped of the drama.
Here is the contrarian reading. The "first" in the headline is doing more work than the facts can carry. It holds only under a narrow reading — first worm aimed at memory infrastructure — and collapses the moment anyone applies it to AI supply chains generally. The real blind spot is subtler and more uncomfortable: the entire conversation that followed is about securing memory. Memory was never the asset.
Two things follow. First, the trigger design required precise knowledge of an agent framework's internal call ordering — when the recall hook fires, where configure_logging is invoked during import. That is insider knowledge or a very long source audit. Second, and more damning, the attacker clearly knew the detection landscape: postinstall hooks are scanned, gitHead is verified, so neither was used. This is a defence-aware attack. It was not built to evade your last rule set by accident. It was built by someone who had read it.
And the reflex answer from my own industry — self-custody fixes this — is wrong. Self-custody solved the problem of who holds the key. It never solved the question of what software holds it while you sleep. Every autonomous treasury bot, every keeper network, every agent-managed vault has an off-chain memory layer where the instructions live. Code is law on-chain. The intent is drafted off-chain, in a package that imports a dependency.
Watch three things in the coming weeks: whether MemTensor publishes a coherent disclosure timeline with real remediation, whether downstream contamination is confirmed in other packages, and whether any leaked prompt material turns out to carry proprietary strategy. That third signal will decide whether this is a credential event or a trade-secret event. I suspect the industry will spend the next quarter arguing about memory encryption standards while the interesting question goes unasked — if the agent's memory is the new private key, who exactly is holding it at three in the morning? When the pool empties, only the intent remains.