SlowMist alert: Multiple MemoryOS and official OpenClaw plugin versions poisoned in supply-chain attack
BIBIBI
AT A GLANCE
SlowMist stated that multiple MemTensor-related packages had been targeted in a supply-chain attack and may execute malicious programs upon loading.
Article
Security alert: MemTensor AI memory components poisoned; PyPI/npm packages execute malicious programs upon loading
BlockBeats reported that on September 24, SlowMist issued an alert stating that MemTensor’s AI long-term memory toolchain had been targeted in a supply-chain attack. The affected components are the open-source library MemoryOS for LLMs/Agents (PyPI version 2.0.34) and the official memtensor/memos-cloud-openclaw-plugin for connecting to the OpenClaw runtime (npm versions 0.1.21, 0.1.23, and 0.1.25). These versions contain cross-platform Go binaries that execute when the packages are imported or when the OpenClaw gateway starts. Attackers may steal developer credentials, including npm/PyPI tokens, GitHub/GitLab credentials, AWS keys, SSH keys, API tokens, and environment variables, and exfiltrate the data; the npm plugin may also leak user prompts.
SlowMist recommends that users immediately uninstall the affected packages or roll back to known-safe versions (npm 0.1.20 and PyPI 2.0.33), terminate related sckit processes, block the associated infrastructure, investigate network activity, and rotate all credentials in affected environments.
Original link https://m.theblockbeats.info/flash/368860
Key points
01
SlowMist issued an alert stating that MemTensor’s AI long-term memory toolchain had been targeted in a supply-chain attack.
02
Affected components include MemoryOS PyPI version 2.0.34 and npm versions 0.1.21, 0.1.23, and 0.1.25 of memtensor/memos-cloud-openclaw-plugin.
03
These versions contain cross-platform Go binaries that execute when the packages are imported or when the OpenClaw gateway starts.
04
Attackers may steal developer credentials, including npm/PyPI tokens, GitHub/GitLab credentials, AWS keys, SSH keys, API tokens, and environment variables, and exfiltrate the data.
05
The evidence states that the npm plugin may also leak user prompts.
06
SlowMist recommends immediately uninstalling or rolling back to npm 0.1.20 and PyPI 2.0.33, terminating related sckit processes, blocking the associated infrastructure, investigating network activity, and rotating all credentials in affected environments.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This is a software supply-chain security alert: after certain packages are installed and imported, or when the relevant gateway starts, they may automatically run malicious programs, causing developer credentials and user prompts to leak.
Why it matters to readers
Developers or organizations using these versions may face credential leakage, abnormal data exfiltration, and subsequent unauthorized-access risks.
If you installed or ran any of the listed versions, check the versions, stop the related processes, and change your credentials as recommended in the alert.
Risks and unknowns
The information was relayed by BlockBeats from a SlowMist alert; the evidence does not include SlowMist’s original announcement or independent technical verification.
The evidence does not specify the actual number of affected installations, the precise scope of the exfiltrated data, or whether credential abuse has already occurred.
The evidence does not provide a list of the associated infrastructure.
Related Developments
Loading event timeline…
Related concepts
Supply-Chain Attack
This term is not in the glossary yet. Browse related concepts in the glossary.
