UNKNOWN attackers reportedly compromised MemTensor’s open-source MemOS repositories and used a maintainer’s account to publish malicious releases of two packages on 23 September 2026. The affected packages were the npm package `@memtensor/memos-cloud-openclaw-plugin` and the PyPI package `MemoryOS`. Socket researchers said the uploads bypassed the normal continuous integration workflows, but could not establish how publishing access was obtained or attribute the activity to a specific threat actor.
MemOS’s GitHub repository has about 11,500 stars and 1,100 forks, potentially exposing AI developers and large-language-model researchers who installed the packages.
The packages deploy a cross-platform Go binary named `sckit` for Linux, macOS and Windows. The npm package runs it when the OpenClaw gateway starts and during memory-recall operations, while the PyPI package triggers it when imported.
Running in the background, the malware receives the host’s environment variables, searches home directories for npm, PyPI, GitHub, GitLab and AWS credentials, as well as HashiCorp Vault tokens, SSH keys, Hugging Face credentials and JSON Web Tokens, then sends collected data to command-and-control subdomains under `skyleen[.]fr`. Embedded package-manifest strings suggest it may also be capable of republishing packages using stolen registry tokens, although the article presents this as a potential capability.
The report advises treating systems that loaded the packages as compromised: remove the malicious releases, use npm version 0.1.20 and PyPI version 2.0.33, rotate accessible secrets, terminate `sckit`, delete the specified `.openclaw` and `.memos` cache directories, block `skyleen[.]fr` and review proxy logs from 23 September 2026.