MemOS npm and PyPI packages shipped a credential stealer

The supply chain attack pattern has found its way into the AI agent stack. On September 23, malicious releases of MemTensor's MemOS — a memory framework for LLMs and agents — went out on both npm and PyPI within hours of each other, carrying a Go binary that walks developer home directories looking for credentials. If any part of your agent tooling pulls MemOS, you have a token rotation to do today.

What actually happened

Per Socket's analysis:

• Four bad releases, two registries. On npm, @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25. On PyPI, MemoryOS version 2.0.34. Each was the latest version on its registry when Socket published. The last clean releases were npm 0.1.20 (August 3) and PyPI 2.0.33 (September 3).
• The payload is a bundled Go binary called sckit, compiled for Linux, macOS and Windows on x64 and arm64. The npm version fires on gateway startup and on memory recalls. The PyPI version fires on module import — so importing the library is enough.
• It is hunting exactly what your CI holds. Socket lists .npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json and stored_tokens, plus environment variables, with NPM_TOKEN and PYPI_API_TOKEN named explicitly. AWS keys, GitHub and GitLab tokens, Vault tokens and SSH keys are all in scope.
• Exfiltration goes to servers under skyleen[.]fr. Block it and search your egress logs back to September 23.
• The project is not small. The main MemOS repository carries roughly 11,500 stars and 1,100 forks — this is a package people install without thinking twice.

Why a poisoned dependency matters for your business

A stealer that grabs NPM_TOKEN is not after your laptop. It is after your next release. One publish token turns a compromised dev machine into a compromised package that your customers install, and the blast radius stops being yours.

Notice what the attacker targeted: not source code, not customer data — the credentials that let them do this again to somebody downstream. That is the whole economy now. Your secrets are inventory.

Three things, in order. Pin or remove: npm to 0.1.20, PyPI to 2.0.33, or drop the dependency. Rotate everything reachable from any machine that installed a bad version — registry tokens, cloud keys, SSH keys, and anything in that shell's environment. Then kill running sckit processes and clear runtime cache directories.

Then fix the structural problem. Publish tokens should not live in a developer's home directory; they belong in a CI secret with a short life and a scoped audience, and releases should come from one signed pipeline rather than from whoever is at a keyboard. A lockfile pinned to exact versions with integrity hashes turns "latest broke us" into a decision you make on purpose. None of that is exotic. It is just work that nobody schedules until a package like this one shows up.

Source: Socket: MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack.