YouTube video by memoryOS

memoryOS is a gamified mobile app designed to significantly improve your memory through short, interactive lessons. Guided by two-time World Memory Champion Jonas von Essen, the software teaches proven mnemonic techniques alongside spaced-repetition schedules. It features a digital library of 3D "Virtual Mind Palaces," which allows users to easily visualize, organize, and store complex information...

Malicious releases of MemTensor’s @memtensor/memos-cloud-openclaw-plugin and MemoryOS package were published on npm and PyPI, respectively, and they drop a cross-platform Go payload named sckit that searches developer home directories for secrets and sends them to C2 infrastructure under skyleen[.]fr. The compromise spans GitHub repository commits, registry releases, and release-tooling changes, putting users, CI runners, and developer machines at risk while exposing tokens and credentials from services such as GitHub, GitLab, AWS, Vault, SSH, and PyPI. #MemTensor #MemOS #OpenClaw #MemoryOS #sckit #skyleenfr

memoryOS combines gamified micro lessons with pre-made virtual mind palaces to improve your memory skills drastically. Proprietary technology and scientifically proven methods. Co-founded by 2X World....

  On September 23, 2026, an attacker spent roughly five hours poisoning two packages belonging to MemTensor, the company behind the MemOS operating system for AI memory. By the time a researcher flagged the issue on GitHub at 4:17 AM UTC, malicious versions were already sitting at the top of the npm and PyPI registries, ready to install for any developer who ran a plain `npm install` or `pip install MemoryOS` that morning. The packages hit were `@memtensor/memos-cloud-openclaw-plugin` on npm and `MemoryOS` on PyPI. Security firm SafeDep, which flagged the incident through its threat intelligence monitoring, found that three npm versions, `0.1.21`, `0.1.23`, and `0.1.25`, and one PyPI version, `2.0.34`, all contained the same Go binary: a credential-harvesting implant the attacker internally called `sckit`, built under the module path `supplychain.local/campaign`. How the Attacker Got Inside the Pipeline The attacker did not need a zero-day. Instead, they exploited a well-understood weakness in how GitHub Actions jobs share environment state. The OpenClaw plugin publishes to npm through a GitHub Actions release workflow that reads its publish token from a repository secret. The attacker, operating through a GitHub account called `Memtensor-AI`, pushed a short-lived branch named `sc/release-0.1.21-20260922-cloud`, made a three-line change to a validation script that runs earlier in the same job, then deleted the branch. They repeated this process five times between 00:48 and 02:03 UTC. The change was precise: it wrote a `BASH_ENV` entry into `$GITHUB_ENV`, which is GitHub's mechanism for passing environment variables between steps. Because Bash reads the file named in `BASH_ENV` before running any non-interactive script, this let the attacker's shell script execute silently before the real publish step. That script called `collectStageZero()` from within the package itself, passed the `NPM_TOKEN` to the `sckit` binary, then deleted itself and exited with a failure code. The publish step failed visibly, so nothing appeared on npm from that run. The token was already gone. The PyPI compromise used the same `BASH_ENV` trick but through a different entry point. The attacker pushed an unsigned commit to the MemOS repository that replaced the standard build backend in `pyproject.toml` with a custom wrapper called `sckit_poetry_build`. On import, that wrapper injected its own bridge script into the CI environment. The bridge ran only inside the PyPI upload action's container, captured `INPUT_PASSWORD` (the PyPI token), sent it to a server at `10729e014d0e.skyleen[.]fr`, and then exited cleanly. Two hours later, a follow-up commit removed the capture code, and the next tag push uploaded the fully malicious wheel to PyPI using MemTensor's own legitimate credentials. What the Package Does After Install The implant activates at runtime, not at install time, so `--ignore-scripts` offers no protection. In the npm plugin, it fires when the OpenClaw gateway starts and again on every memory recall. In the Python library, it starts the first time `configure_logging()` runs, which happens on nearly every import path. The binary launches detached in the background with no output. Once running, `sckit` scans the entire home directory for credentials. Its target list, visible in its strings and symbol names, covers `.npmrc`, `.pypirc`, `.git-credentials`, `.netrc`, SSH private keys, HashiCorp Vault tokens, and Microsoft MSAL token caches. Two compiled regular expressions recognize both secret-like variable names and token format patterns for AWS, GitHub, npm, PyPI, HuggingFace, Slack, and Stripe. Collected data goes to subdomains of `skyleen[.]fr`, the campaign's control infrastructure, over encrypted channels using X25519 key exchange and XChaCha20-Poly1305. The binary also carries worm logic. Functions named `findRepositories`, `prepareRemoteNode`, `prepareRemotePython`, and `recursivePublish` describe how it uses stolen credentials to inject itself into other repositories. It plants a GitHub Actions workflow named `runtime-update.yml` and a `.sckit/` directory into reachable projects, turning each victim into a potential carrier. The campaign configuration encodes an expiry date of late October 2026, suggesting the attacker planned a defined window of operation. Developers Need to Act Now Anyone who ran an affected version should treat every credential in their home directory as stolen. That includes cloud CLI tokens, SSH keys, and any `.env` files. SafeDep recommends pinning to `0.1.20` for the npm plugin and `2.0.33` for `MemoryOS`, killing any running `sckit` process, deleting the state directories at `$HOME/.openclaw/.cache/runtime` and `$HOME/.memos/.cache/runtime`, and checking any repository with push access for the `runtime-update.yml` workflow file. The attack sits inside a larger pattern. The first half of 2026 alone produced 37 supply chain attack campaigns and 497 indexed malicious packages, which is 4.5 times the package volume of the entire preceding year. What separates this incident is the operational sophistication: the attacker used the target project's own CI pipeline as the delivery mechanism, left no workflow run logs behind, and built self-propagation directly into the implant. For maintainers who publish from CI, PyPI's trusted publishing removes long-lived tokens from the job entirely. Required reviewers on release environments would have blocked the MemTensor runs before they started.

YouTube video by memoryOS

memoryOS is a gamified mobile app designed to significantly improve your memory through short, interactive lessons. Guided by two-time World Memory Champion Jonas von Essen, the software teaches pr…

memoryOS is a gamified mobile app designed to significantly improve your memory through short, interactive lessons. Guided by two-time World Memory Champion Jonas von Essen, the software teaches pr…

memoryOS is a gamified mobile app designed to significantly improve your memory through short, interactive lessons. Guided by two-time World Memory Champion Jonas von Essen, the software teaches proven mnemonic techniques alongside spaced-repetition schedules. It features a digital library of 3D “Virtual Mind Palaces,” which allows users to easily visualize, organize, and store complex information […]

TL;DR: Make 2026 the year you sharpen up your mind with a 5-year subscription to memoryOS Expert Plan, on sale now $142.97 (reg. $749.95). $142.97 $749.95 Save $606.98   Want to finish out the year with a better memory? There’s now an app for that — memoryOS. This brain-training tool makes improving your memory fun with bite-sized lessons scientifically proven to be effective.

**TL;DR:** Get memoryOS Expert Plan (1-year) for just $74.99 (MSRP $149.99) and train your memory with proven techniques for a 70% recall boost. If you’ve ever forgotten a name five seconds after hearing it or struggled to recall details during a meeting, you’re not alone. But what if you could actually train your memory the way you’d train a muscle? MemoryOS is a memory-sharpening app designed to help you boost recall by up to 70% — and right now, you can grab a 1-year Expert Plan subscription for just $74.99. Unlike gimmicky brain games, memoryOS uses scientifically proven techniques like mnemonics and spaced repetition, paired with the centuries-old “Mind Palace” method, now reimagined in virtual 3D. It’s part app, part game, and part mental workout. * Virtual Mind Palaces to store and recall info effortlessly * Gamified micro-lessons that fit into your daily routine * World Memory Champion guidance along your learning path * Scientifically proven methods digitized for modern use * A community of early adopters for extra support Whether you’re a professional prepping for presentations, a student tackling exams, or just tired of those “what was I doing again?” moments, memoryOS helps you think clearly, recall quicker, and feel sharper. Get a year of the memoryOS Expert Plan for just $74.99 (MSRP $149.99) for a limited time. memoryOS Expert Plan: 1-Year SubscriptionSee Deal _StackSocial_ _prices subject to change._

TL;DR: Make 2026 the year you sharpen up your mind with a 5-year subscription to memoryOS Expert Plan, on sale now $142.97 (reg. $749.95). $142.97 $749.95 Save $606.98   Want to finish out the year with a better memory? There’s now an app for that — memoryOS. This brain-training tool makes improving your memory fun with bite-sized lessons scientifically proven to be effective.

Large Language Models (LLMs) face a crucial challenge from fixed context windows and inadequate memory management, leading to a severe shortage of long-term memory capabilities and limited personalization in the interactive experience with AI agents. To overcome this challenge, we innovatively propose a Memory Operating System, i.e., MemoryOS, to achieve comprehensive and efficient memory management for AI agents. Inspired by the memory management principles in operating systems, MemoryOS designs a hierarchical storage architecture and consists of four key modules: Memory Storage, Updating, Retrieval, and Generation. Specifically, the architecture comprises three levels of storage units: short-term memory, mid-term memory, and long-term personal memory. Key operations within MemoryOS include dynamic updates between storage units: short-term to mid-term updates follow a dialogue-chain-based FIFO principle, while mid-term to long-term updates use a segmented page organization strategy. Our pioneering MemoryOS enables hierarchical memory integration and dynamic updating. Extensive experiments on the LoCoMo benchmark show an average improvement of 49.11% on F1 and 46.18% on BLEU-1 over the baselines on GPT-4o-mini, showing contextual coherence and personalized memory retention in long conversations. The implementation code is open-sourced at https://github.com/BAI-LAB/MemoryOS.