Compromised MemTensor releases deliver credential theft through AI memory tools

Attackers published malicious MemTensor packages on September 23: npm OpenClaw plugin versions 0.1.21, 0.1.23 and 0.1.25, and PyPI MemoryOS 2.0.34. Research identifies a Go implant named sckit that steals developer secrets and contains machinery for spreading through repositories and package registries.

Brief updated 25 Sep 2026, 02:25 UTC · AI-written

SafeDep traced token theft to modified GitHub Actions release jobs. Clean npm versions appeared between malicious releases, making version-specific evidence more useful than assuming every release that day was compromised.

Execution occurs when the software loads, rather than through an installation hook. SafeDep therefore says disabling npm installation scripts does not prevent execution. SC Media also reports exposure of OpenClaw prompts and credentials spanning cloud, source-control and publishing services.

What remains unclear

Propagation capability is documented, but the opened evidence does not establish the number of downstream projects infected.