Malicious releases tied to MemTensor’s MemOS framework appeared on npm and PyPI on Sept. 23, carrying the Go-based sckit credential stealer. The code can expose prompts and credentials and is designed to spread to other packages, but no downstream spread has been confirmed.
Affected releases were npm @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25, and PyPI MemoryOS 2.0.34. Clean npm versions 0.1.22 and 0.1.24 appeared between malicious releases. The compromise began with direct commits to MemTensor’s GitHub repositories through maintainer account leason1974.
The malware is triggered through package code, not install hooks: the npm code runs at OpenClaw startup and on memory-recall events, while importing memos can trigger it in Python. It can harvest 13 categories of credentials, including registry, source-control, cloud and SSH secrets, and send them to skyleen[.]fr and subdomains. The article recommends pinning npm to 0.1.20 and PyPI to 2.0.33 or removing the packages, then rotating credentials accessible to affected environments.
