Source: socket.dev
On September 23, 2026, a threat actor compromised MemTensor's MemOS open source AI memory framework by publishing malicious releases on both npm and PyPI registries. Three versions of the npm package @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and one PyPI version of MemoryOS (2.0.34) were affected, with the malicious versions currently tagged as latest. Each compromised package bundles cross-platform Go binaries named 'sckit' built for Linux, macOS, and Windows on x64 and arm64 architectures. The payload searches developer home directories for credentials including npm/PyPI tokens, GitHub/GitLab tokens, AWS keys, SSH keys, Vault tokens, and various API keys, then exfiltrates them to C2 servers under skyleen[.]fr. The malicious code also appeared in commits to MemTensor's GitHub repositories, suggesting a deeper supply chain compromise potentially targeting the release pipeline itself. The binaries contain strings suggesting potential worm behavior, capable of republishing packages using stolen registry tokens. The npm plugin additionally exfiltrates user prompt text on every memory recall operation.
