Compromised MemTensor packages expose developer credentials

Attackers compromised legitimate MemTensor packages on npm and the Python Package Index to deliver a credential-stealing program called sckit, according to security researchers cited by The Hacker News. The affected releases include three versions of the @memtensor/memos-cloud-openclaw-plugin package and MemoryOS 2.0.34. The npm payload runs when an agent gateway starts or handles a memory request; the Python payload runs when the module is imported. Researchers say the program collects cloud, source-code and package-publishing credentials and can receive tasks from an external server. The MemoryOS project has been quarantined on PyPI, while the affected npm versions were still available for download when reported.