# MemTensor's Latest Tag Was the Implant. Clean Builds Lasted Minutes. > On 23 September 2026 MemTensor published three bad npm builds of its OpenClaw memory plugin and PyPI MemoryOS 2.0.34. Each started a credential stealer on gateway boot, recall, or import. Clean builds between them lasted minutes. By 24 September the bad versions were gone and npm latest was 0.1.24. Hosts that loaded a bad build are still in scope. Source: https://hackerlogs.com/blog/memtensor-sckit-latest-tag Published: 2026-09-24 ## Key takeaways - Socket's primary is three npm versions of @memtensor/memos-cloud-openclaw-plugin, 0.1.21, 0.1.23, and 0.1.25, plus PyPI MemoryOS 2.0.34. Each bundled a Go binary named sckit. - The package clock is minutes. A clean 0.1.22 lasted under four minutes before 0.1.23. A clean 0.1.24 lasted about three minutes before 0.1.25 was tagged latest. - The binary starts on gateway boot, on memory recall with the prompt text, or on import. A test container that imported memos is in the same blast as a developer laptop. - Socket has not confirmed how registry access was obtained. The npm publishes have no gitHead. The Hacker News attributes to SafeDep a claim that the release workflow handed over the token. - On 24 September the bad versions were gone from the public version lists and npm latest was 0.1.24. That closes the package clock. It does not close a token already read from a home directory. On 23 September a legitimate MemTensor plugin that gives OpenClaw agents a memory store shipped a credential stealer as `latest`. [Socket](https://socket.dev/blog/memtensor-compromise) is the primary. Three npm versions of `@memtensor/memos-cloud-openclaw-plugin` and PyPI `MemoryOS` 2.0.34 each start a Go binary named sckit. A check of the public registries on 24 September shows those four versions removed and npm `latest` pointed at 0.1.24. Removal is the package clock. It is not the impact clock. US X trends were football, a prime minister, and an Apple Watch. Hacker News did not lead with this. The Hacker News, Socket, StepSecurity, and Aikido did. A maintained agent plugin and its Python library published a token stealer under the real names. High because install, gateway start, and import were enough, not because a second package is confirmed wormed. Three panels for the MemTensor plugin compromise: clean and malicious publishes a few minutes apart, a binary that starts when the agent plugin loads, and a registry removal that leaves stolen tokens in scope. ## What Socket actually published. MemOS is MemTensor's open-source memory framework for language models and agents. Socket puts the main GitHub repository at about 11,500 stars. This was not a typosquat next to a famous name. The npm package is the OpenClaw lifecycle plugin: it recalls memory before a prompt and writes memory after a run. StepSecurity notes the same package also declares hooks for the Clawdbot and Moltbot runtimes. The PyPI package is `MemoryOS`. The bad npm versions are 0.1.21, 0.1.23, and 0.1.25. The bad PyPI version is 2.0.34. Each bundles sckit for Linux, macOS, and Windows, on both 64-bit architectures. Socket's static read, which did not execute the samples, says the binary searches the home directory and the process environment for registry tokens, git credentials, cloud keys, Vault tokens, SSH keys, and a list of other well-known token shapes, then reports to hosts under `skyleen.fr`. On the npm plugin the binary is started when the OpenClaw gateway starts, and again on every memory recall, with the user's prompt text passed in. On PyPI, importing `memos` is enough, because the launcher is wired through logging setup that runs on import. The publishes came from the same npm account as earlier legitimate releases, `leason1974`, and they have no `gitHead`. Socket's conclusion is that those npm cuts were not made by the project's CI workflow. It has not confirmed how publish access was obtained. Two commits, authored as `Memtensor-AI` and `MemTensor CI Review`, added the binaries and changed the release tooling so that it targets the registry publish token. When Socket looked, no branch or tag in either repository pointed at those commits. > A clean main branch does not make `latest` clean. Socket could not see the malicious commits on a branch or a tag, and the bad npm versions were not cut from CI. For part of 23 September, `latest` was 0.1.25 anyway. [The Hacker News](https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html), citing SafeDep, says the attacker got the publish tokens when commits caused the GitHub Actions release workflow to hand them over. Socket does not confirm that path. Rotate the token without waiting for the two write-ups to agree. ## The package clock and the impact clock. All times are UTC on 23 September, from Socket and StepSecurity, and they match the timestamps still on the npm registry record. The last known-good npm build, 0.1.20, was 3 August. The last PyPI build before the compromise, 2.0.33, was 3 September. Then the channel flipped. Malicious npm 0.1.21 at 02:23. Clean 0.1.22 at 03:45, matching 0.1.20 apart from version strings. Malicious 0.1.23 at 03:49, three minutes and thirty-six seconds later. Clean 0.1.24 at 04:33. Malicious 0.1.25 at 04:36, about three minutes later, tagged `latest`. PyPI 2.0.34 at 05:25. The wheel jumped from 951,210 bytes on 2.0.33 to 19,201,772 bytes. The growth is the bundled binaries. That is the package clock: a maintainer-looking account, a clean build that does not stick, and `latest` meaning the implant. The npm record's `modified` time is 11:53 the same day. On 24 September the public version list no longer contains 0.1.21, 0.1.23, or 0.1.25. Dist-tags point `latest` at 0.1.24 and carry two extra tags, `clean-inverse-0-1-23` and `clean-inverse-0-1-25`, aimed at the clean neighbors. PyPI's current version is 2.0.33. 2.0.34 is not in the release list. The Hacker News' update matches that takedown. An August beta, 0.1.21-beta.0, is still on npm. Socket did not name it. Do not confuse it with the removed 0.1.21. > The impact clock starts at load, not at the advisory. Socket's rule: if any environment loaded npm 0.1.21, 0.1.23, or 0.1.25, or imported MemoryOS 2.0.34, treat that host as compromised. The same rule covers a CI job and a container that only ran tests. The config Socket recovered carries a not-after date of 22 October 2026. A stolen publish token does not honor that date. The shape is the one in the [TanStack token](/blog/tanstack-token-lasted-months) and the [mathmain loader](/blog/mathmain-encrypted-loader). The registry can pull a version in an afternoon. A lockfile, a cache, and a laptop do not pull themselves. Aikido reads the binary as built to republish into other npm and PyPI packages and to drop a GitHub Actions template. It had not found a compromised public workflow when it published. Assume the worm is a capability until a second package shows up. Do not assume it already has. ## What this is not. It is not a typosquat, and it is not a new package with no history. The stars, the prior versions, and the publish account are why a default install was rational on the morning of 23 September. It is not proof that every OpenClaw, Clawdbot, or Moltbot install is owned. The blast is environments that resolved the bad versions or imported MemoryOS 2.0.34. A pin to 0.1.20 or 0.1.24, or to MemoryOS 2.0.33, was outside that set on Socket's comparison. It is not a confirmed second-wave publish into unrelated packages. Aikido and The Hacker News both leave that open. The hunt is your own publish history if the affected host held a token, not a claim that the registry is broadly poisoned. It is also not a CVE you can wait on. None of the primaries used here lead with a CVE number. The ticket name is the package, the four versions, and the date. ## What to do. 1. Search lockfiles, `requirements` files, `poetry.lock`, `uv.lock`, and SBOMs for `@memtensor/memos-cloud-openclaw-plugin` and `MemoryOS`. If you resolved 0.1.21, 0.1.23, 0.1.25, or 2.0.34, the host is in scope even though the registry listing is gone. Include CI runners and test images. 2. Pin npm to 0.1.20 or 0.1.24, and PyPI to 2.0.33, or remove the dependency. Socket says 0.1.22 and 0.1.24 differ from 0.1.20 only in version strings. Diff anyway. A floating `latest` is how 0.1.25 became the default for the hours it was tagged. 3. Rotate every secret that lived in that user account or CI job. Socket names npm and PyPI tokens, GitHub and GitLab tokens, AWS keys, Vault tokens, SSH keys, and the usual collaboration and payment tokens. Prompt text that passed through the plugin on a bad version should be treated as exposed. 4. Block `skyleen.fr` and its subdomains. Look for egress to that domain since 23 September. Then look for publishes of your own packages that you did not cut, if the host could publish. 5. Alert on this plugin's release cadence, not only on a new CVE. The clean builds were real, and they lasted minutes. A job that pins `latest` and sleeps overnight will install whichever tag is winning at resolve time. 6. Split the agent runtime from the publish token. A memory plugin that runs on gateway start does not need `NPM_TOKEN` in its environment. The [TanStack](/blog/tanstack-token-lasted-months) lesson was the same: the package clock is public and fast, and the token spends in private after the version is gone. The Hacker News front page on 24 September was the OpenAI scanner story, not this plugin. The operator fact is still the tag. For a few hours, the latest build of a popular agent memory plugin was the implant, and a clean build in between was not a rescue. ## Sources - [MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack](https://socket.dev/blog/memtensor-compromise) (2026-09-23) - [Sckit Supply Chain Worm Hits MemTensor npm and PyPI scopes](https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes) (2026-09-23) - [Novel supplychain.local Go worm appears](https://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypi) (2026-09-23) - [Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI](https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html) (2026-09-23)