MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack

What it is

Supply-chain compromise (published September 23, 2026) of MemTensor's MemOS. Malicious releases: npm @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, 0.1.25 and PyPI MemoryOS 2.0.34, each currently tagged latest. Last known-good releases are npm 0.1.20 and PyPI 2.0.33. Note the version churn: npm 0.1.22 and 0.1.24 differ from clean 0.1.20 only in version strings, and all six bundled sckit binaries are byte-for-byte identical across the malicious npm releases. The PyPI compromise is visible in size: the 2.0.34 wheel is 19,201,772 bytes vs 951,210 for 2.0.33.

How it triggers

Load/import is enough — no explicit API call.

• PyPI: the wheel modifies memos/log.py so configure_logging() calls memos._stage0.trigger(). 149 modules call get_logger() at module level (including one imported by memos/__init__.py), so import memos fires the payload once per process. All exceptions swallowed.
• npm: index.js imports lib/sckit.js and calls launchStageZero() twice — once when the OpenClaw gateway starts, and again inside the memory-recall hook with the user's prompt in SCKIT_EVENT_TEXT.

The binary runs detached with the full host environment. Config passed base64 via --config64; C2 servers under skyleen[.]fr expose /config, /status, /batch. Config has a not_after expiry of October 22, 2026. Malicious code also appears in GitHub commits e0c1ca3 (plugin) and b52958f (MemOS), both altering release tooling to grab the publish token.

Affected

Any host that loaded the npm versions or imported MemoryOS 2.0.34 — developer machines, CI runners, and containers that only ran tests are all in scope.

What to do

• Pin or remove. Search lockfiles, requirements*.txt, poetry.lock, uv.lock and SBOMs for the two package names. Pin npm to 0.1.20, PyPI to 2.0.33, or uninstall. Do not trust latest.
• Rotate every secret reachable from the affected user's $HOME/environment: npm, PyPI, GitHub, GitLab tokens; AWS keys; Vault tokens; SSH keys; Hugging Face, Slack, Stripe, SendGrid keys; .env and shell-env values.
• Clean artifacts. Kill any running sckit process, then delete the package directories plus ~/.openclaw/.cache/runtime/ and ~/.memos/.cache/runtime/.
• Block and hunt. Block skyleen[.]fr and all subdomains; review DNS/proxy/egress logs for it since September 23, 2026.
• Check your own releases. If an affected host held npm/PyPI publish tokens, audit your packages for versions you did not publish (worm-republish behavior is suspected from strings about encoding manifests and installing repo files).
• Prompt exposure. For the npm plugin, assume prompts sent while an affected version was loaded reached the attacker.

Caveats

Findings are from static analysis only — Socket did not execute the samples, and payload/C2 details are still being analyzed. Socket could not confirm how publishing access was obtained; the npm releases came from the legitimate leason1974 account but without a gitHead, indicating they bypassed CI.