Reported by 6 outlets
MemTensor Supply Chain Compromise - sckit Credential Stealer
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Two legitimate MemTensor publishing channels were compromised on September 23, 2026 to deliver sckit, a Go-based credential stealer, to users of the MemOS AI memory framework. On npm, versions 0.1.21, 0.1.23 and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin were malicious, published between 02:23 and 04:37 UTC; interleaved versions 0.1.22 and 0.1.24 were clean and the latest tag now points at clean 0.1.24. On PyPI, a malicious MemoryOS 2.0.34 wheel appeared about a minute after a GitHub release published by the Memtensor-AI account at 05:24:20 UTC on commit 41bf5c7, preceded by a token-capture build under a since-deleted tag named v2.0.34-capture-1.
The intrusion path is the notable part: the attacker never pushed code to the repository. They got into the project's GitHub Actions release workflow, captured the publish tokens before the legitimate job ran, and shipped the malware under the maintainer's own credentials, so the packages appeared signed and trusted. GitHub user omeridel flagged that npm versions 0.1.21 and 0.1.23 correspond to no commit or tag in the repository and contain a credential-harvesting payload; SafeDep's analysis of the sckit worm built from that report.
This follows the 2025 pattern of trusted-maintainer publishing abuse, but aimed specifically at the AI developer ecosystem: anyone pulling MemTensor packages in CI consumes the stealer automatically. The deleted capture tag and the interleaved clean releases suggest deliberate opsec rather than a one-off token leak.
Teams using MemTensor packages should verify installed versions against the clean 0.1.24 line and audit for sckit, rotate npm, PyPI and GitHub tokens used in the affected workflows, and require OIDC-based publishing or provenance attestation so release credentials cannot be harvested from Actions runners. Watch for the same token-capture technique appearing against other AI-framework maintainers.
Timeline
-
original reporting
🤖 Supply chain: two legitimate MemTensor packages on npm and PyPI were compromised to push "sckit", a Go-based credential stealer targeting
thehackernews.com · 20d ago · September 24th, 2026
🤖 Supply chain: two legitimate MemTensor packages on npm and PyPI were compromised to push "sckit", a Go-based credential stealer targeting
via Mastodon https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html
-
update from registry.npmjs.org
npm registry publish record for @memtensor/memos-cloud-openclaw-plugin 0.1.21, the first malicious release
registry.npmjs.org · 21d ago · September 23rd, 2026
The npm registry timestamps version 0.1.21 at 2026-09-23T02:23:04.778Z, followed by 0.1.22 (03:45:44), 0.1.23 (03:49:20), 0.1.24 (04:33:30) and 0.1.25 (04:36:58) the same morning. Versions 0.1.21, 0.1.23 and 0.1.25 were later identified as malicious; 0.1.22 and 0.1.24 are clean. Current dist-tags point latest at the clean 0.1.24.
-
update from github.com
Original researcher disclosure: issue 173 on MemTensor/MemOS-Cloud-OpenClaw-Plugin
github.com · 21d ago · September 23rd, 2026
GitHub user omeridel reported that npm versions 0.1.21 and 0.1.23 of @memtensor/memos-cloud-openclaw-plugin correspond to no commit or tag in the repository and contain a credential-harvesting payload, noting 0.1.23 was then the latest tag. The report came from automated supply-chain monitoring and was verified by downloading and diffing the published artifacts. SafeDep's analysis of the sckit worm started from this issue.
-
update from github.com
GitHub release v2.0.34 on MemTensor/MemOS that produced the malicious PyPI upload
github.com · 20d ago · September 23rd, 2026
The GitHub release that triggered the repository's PyPI publishing workflow was published at 2026-09-23T05:24:20Z by the account Memtensor-AI, with its tag on commit 41bf5c7. The malicious MemoryOS 2.0.34 wheel reached PyPI about a minute later. Researchers later showed the release was preceded by a token-capture build under a deleted tag named v2.0.34-capture-1.
-
update from securityonline.info
Discover the critical MemTensor MemOS compromise details. This MemTensor MemOS compromise targets AI developers via malicious npm and PyPI p
securityonline.info · 20d ago · September 23rd, 2026
Discover the critical MemTensor MemOS compromise details. This MemTensor MemOS compromise targets AI developers via malicious npm and PyPI p
via Mastodon https://securityonline.info/memtensor-memos-compromise/?utm_source=mastodon&utm_medium=jetpack_social
-
update from safedep.io
MemTensor npm and PyPI packages were backdoored today through their own CI pipeline
safedep.io · 20d ago · September 23rd, 2026
The attacker didn't push code directly. They got into MemTensor's GitHub Actions release workflow, intercepted the publish tokens before the real job ran, then used those tokens to ship the malicious packages themselves. submitted by /u/BattleRemote3157 [link] [comments]
via reddit r/cybersecurity: MemTensor npm and PyPI packages were backdoored today through their own CI pipeline
-
update from blog.relayshield.net
The MemTensor worm didn't attack users: it stole a maintainer's credentials and published malware AS them. Signed, trusted, into npm and PyP
blog.relayshield.net · 15d ago · September 28th, 2026
The MemTensor worm didn't attack users: it stole a maintainer's credentials and published malware AS them. Signed, trusted, into npm and PyP
via Mastodon https://blog.relayshield.net/your-laptop-is-the-supply-chain