memoryos

Details

**Severity:** Critical

**Affected versions:** `= 2.0.34`

## Source: kam193 (d17530b4f32046961be6354a73139dafa5a7d73ca9f7226dcf6bb3a3510bde20)
Versions 2.0.34 were compromised.


The package was compromised and contains a malicious executable. First discovered by Safedep.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-compr-memoryos


Reasons (based on the campaign):


 - compromised-package

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/996769d5ac832b5894a0d8eb1e8ddc65a53470c8/osv/malicious/pypi/memoryos/MAL-2026-16475.json))

**References:**
- https://bad-packages.kam193.eu/pypi/campaign/2026-09-compr-memoryos
- https://github.com/ossf/malicious-packages/blob/996769d5ac832b5894a0d8eb1e8ddc65a53470c8/osv/malicious/pypi/memoryos/MAL-2026-16475.json
- https://safedep.io/memtensor-sckit-worm-npm-pypi
- https://www.virustotal.com/gui/file/8f647f17a1934679c4095e21bee2b9bd83e28476603758bc91408a0c8443e3b4/detection
- https://github.com/ossf/malicious-packages/blob/4ff50359dc7f9c5ce6f1dae607fd8c96dfc8b5d2/osv/malicious/pypi/memoryos/MAL-2026-16475.json
- https://pypi.org/project/MemoryOS/2.0.34
- https://github.com/ossf/malicious-packages/blob/76bec26075961f2df85ce2651dda50ea75c3ee82/osv/malicious/pypi/memoryos/MAL-2026-16475.json
- https://github.com/ossf/malicious-packages/blob/fc669e9432ea898659475b71ac796d0ec97f0cbb/osv/malicious/pypi/memoryos/MAL-2026-16475.json

Compromised versions (1)

• = 2.0.34

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.