MemTensor's Latest Tag Was the Implant. Clean Builds Lasted Minutes.

On 23 September a legitimate MemTensor plugin that gives OpenClaw agents a memory store shipped a credential stealer as latest. Socket is the primary. Three npm versions of @memtensor/memos-cloud-openclaw-plugin and PyPI MemoryOS 2.0.34 each start a Go binary named sckit. A check of the public registries on 24 September shows those four versions removed and npm latest pointed at 0.1.24. Removal is the package clock. It is not the impact clock.

US X trends were football, a prime minister, and an Apple Watch. Hacker News did not lead with this. The Hacker News, Socket, StepSecurity, and Aikido did.

High A maintained agent plugin and its Python library published a token stealer under the real names. High because install, gateway start, and import were enough, not because a second package is confirmed wormed.

What Socket actually published.#

MemOS is MemTensor's open-source memory framework for language models and agents. Socket puts the main GitHub repository at about 11,500 stars. This was not a typosquat next to a famous name. The npm package is the OpenClaw lifecycle plugin: it recalls memory before a prompt and writes memory after a run. StepSecurity notes the same package also declares hooks for the Clawdbot and Moltbot runtimes. The PyPI package is MemoryOS.

The bad npm versions are 0.1.21, 0.1.23, and 0.1.25. The bad PyPI version is 2.0.34. Each bundles sckit for Linux, macOS, and Windows, on both 64-bit architectures. Socket's static read, which did not execute the samples, says the binary searches the home directory and the process environment for registry tokens, git credentials, cloud keys, Vault tokens, SSH keys, and a list of other well-known token shapes, then reports to hosts under skyleen.fr. On the npm plugin the binary is started when the OpenClaw gateway starts, and again on every memory recall, with the user's prompt text passed in. On PyPI, importing memos is enough, because the launcher is wired through logging setup that runs on import.

The publishes came from the same npm account as earlier legitimate releases, leason1974, and they have no gitHead. Socket's conclusion is that those npm cuts were not made by the project's CI workflow. It has not confirmed how publish access was obtained. Two commits, authored as Memtensor-AI and MemTensor CI Review, added the binaries and changed the release tooling so that it targets the registry publish token. When Socket looked, no branch or tag in either repository pointed at those commits.

The package clock and the impact clock.#

All times are UTC on 23 September, from Socket and StepSecurity, and they match the timestamps still on the npm registry record.

The last known-good npm build, 0.1.20, was 3 August. The last PyPI build before the compromise, 2.0.33, was 3 September. Then the channel flipped. Malicious npm 0.1.21 at 02:23. Clean 0.1.22 at 03:45, matching 0.1.20 apart from version strings. Malicious 0.1.23 at 03:49, three minutes and thirty-six seconds later. Clean 0.1.24 at 04:33. Malicious 0.1.25 at 04:36, about three minutes later, tagged latest. PyPI 2.0.34 at 05:25. The wheel jumped from 951,210 bytes on 2.0.33 to 19,201,772 bytes. The growth is the bundled binaries.

That is the package clock: a maintainer-looking account, a clean build that does not stick, and latest meaning the implant. The npm record's modified time is 11:53 the same day. On 24 September the public version list no longer contains 0.1.21, 0.1.23, or 0.1.25. Dist-tags point latest at 0.1.24 and carry two extra tags, clean-inverse-0-1-23 and clean-inverse-0-1-25, aimed at the clean neighbors. PyPI's current version is 2.0.33. 2.0.34 is not in the release list. The Hacker News' update matches that takedown. An August beta, 0.1.21-beta.0, is still on npm. Socket did not name it. Do not confuse it with the removed 0.1.21.

The shape is the one in the TanStack token and the mathmain loader. The registry can pull a version in an afternoon. A lockfile, a cache, and a laptop do not pull themselves. Aikido reads the binary as built to republish into other npm and PyPI packages and to drop a GitHub Actions template. It had not found a compromised public workflow when it published. Assume the worm is a capability until a second package shows up. Do not assume it already has.

1. 2026-08-03
   npm 0.1.20 publishes. Socket's last known-good plugin release.
2. 2026-08-17
   npm 0.1.21-beta.0 publishes. Still listed on 24 September. Not in Socket's malicious set.
3. 2026-09-03
   PyPI MemoryOS 2.0.33 publishes. Last release before the compromise.
4. 2026-09-23
   02:23 to 05:25 UTC: three bad npm versions and MemoryOS 2.0.34, with clean 0.1.22 and 0.1.24 lasting minutes between them. 0.1.25 is tagged latest.
5. 2026-09-23
   11:53 UTC: npm record modified. By 24 September the three bad versions and the PyPI release are off the public lists. Latest is 0.1.24.
6. 2026-10-22
   Not-after date inside the config Socket recovered. A date on the implant, not an expiry for tokens it already read.

What this is not.#

It is not a typosquat, and it is not a new package with no history. The stars, the prior versions, and the publish account are why a default install was rational on the morning of 23 September.

It is not proof that every OpenClaw, Clawdbot, or Moltbot install is owned. The blast is environments that resolved the bad versions or imported MemoryOS 2.0.34. A pin to 0.1.20 or 0.1.24, or to MemoryOS 2.0.33, was outside that set on Socket's comparison.

It is not a confirmed second-wave publish into unrelated packages. Aikido and The Hacker News both leave that open. The hunt is your own publish history if the affected host held a token, not a claim that the registry is broadly poisoned.

It is also not a CVE you can wait on. None of the primaries used here lead with a CVE number. The ticket name is the package, the four versions, and the date.

What to do.#

1. Search lockfiles, requirements files, poetry.lock, uv.lock, and SBOMs for @memtensor/memos-cloud-openclaw-plugin and MemoryOS. If you resolved 0.1.21, 0.1.23, 0.1.25, or 2.0.34, the host is in scope even though the registry listing is gone. Include CI runners and test images.
2. Pin npm to 0.1.20 or 0.1.24, and PyPI to 2.0.33, or remove the dependency. Socket says 0.1.22 and 0.1.24 differ from 0.1.20 only in version strings. Diff anyway. A floating latest is how 0.1.25 became the default for the hours it was tagged.
3. Rotate every secret that lived in that user account or CI job. Socket names npm and PyPI tokens, GitHub and GitLab tokens, AWS keys, Vault tokens, SSH keys, and the usual collaboration and payment tokens. Prompt text that passed through the plugin on a bad version should be treated as exposed.
4. Block skyleen.fr and its subdomains. Look for egress to that domain since 23 September. Then look for publishes of your own packages that you did not cut, if the host could publish.
5. Alert on this plugin's release cadence, not only on a new CVE. The clean builds were real, and they lasted minutes. A job that pins latest and sleeps overnight will install whichever tag is winning at resolve time.
6. Split the agent runtime from the publish token. A memory plugin that runs on gateway start does not need NPM_TOKEN in its environment. The TanStack lesson was the same: the package clock is public and fast, and the token spends in private after the version is gone.

The Hacker News front page on 24 September was the OpenAI scanner story, not this plugin. The operator fact is still the tag. For a few hours, the latest build of a popular agent memory plugin was the implant, and a clean build in between was not a rescue.