Slow Mist: MemoryOS and OpenClaw plug-ins are poisoned

PANews reported on September 24 that according to the SlowMist security warning, MemTensor’s AI memory tool chain was compromised. MemoryOS (PyPI), an open source long-term memory library for LLM and AI Agents, and memtensor/memos-cloud-openclaw-plugin (npm), an official plug-in to connect to the OpenClaw runtime, are embedded in the cross-platform Go binary. The malicious program triggers execution when the package is loaded or imported.

Affected versions include: MemoryOS==2.0.34 on PyPI, and npm plugins 0.1.21, 0.1.23, 0.1.25. Among them, the affected npm plug-in may also cause the user prompt content to be leaked.

SlowMist recommends the following measures: uninstall or downgrade to known safe versions (npm 0.1.20, PyPI 2.0.33); terminate the sckit process; block related infrastructure; check network activity; and rotate credentials in the affected environment.

Actualités liées

Analyst: The total amount of funds stolen by the Lazarus Group reached $11.87 billion, equivalent to 45% of North Korea's GDP in 2025.

Machi sold BAYC #950 and BAYC #5310 through an over-the-counter transaction.

Analyste : L'offre des détenteurs de BTC à court terme est en cours de réévaluation, avec une absorption qui émerge dans la fourchette de 75 000 $ à 78 000 $.

La banque centrale tiendra un symposium sur les prêts relais destinés aux rachats d'actions et à l'augmentation des participations.

L'Amérique du Nord a commencé à observer l'heure standard, et l'heure d'ouverture du marché boursier américain a été ajustée à 22h30.