Credential Theft Vulnerability in MemoryOS 2.0.34
Summary
PYSEC-2026-3987: MemoryOS 2.0.34 was published with a credential-stealing binary. Affects memoryos versions 2.0.34. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MemoryOS is a Python package designed for managing and optimizing memory usage in applications. It provides tools for monitoring memory consumption and offers features to enhance performance. However, version 2.0.34 was compromised, leading to a significant security vulnerability that allows attackers to steal sensitive credentials from users' systems.
Vulnerability Detail
In version 2.0.34 of MemoryOS, an attacker with write access to the GitHub repository introduced malicious commits that included a credential-stealing binary. When users import this compromised package, it executes a script (memos/_stage0.py) that launches a bundled binary (sckit). This binary collects sensitive information such as .pypirc, .npmrc, .git-credentials, SSH keys, and token-like environment variables, sending them to a remote server (skyleen.fr). The vulnerability poses a severe risk as it can lead to unauthorized access to users' accounts and systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the compromised version by specifying an earlier version of MemoryOS in your requirements file or installation command. For example, use pip install memoryos==2.0.33 to install the last known safe version.
Conclusion
The discovery of a credential-stealing vulnerability in MemoryOS 2.0.34 highlights the importance of maintaining secure coding practices and monitoring for unauthorized changes in open-source projects. Users are urged to take immediate action to protect their credentials and systems.
See every vulnerability recorded for memoryos →
FAQ
You should uninstall MemoryOS 2.0.34 immediately and rotate any credentials that may have been compromised.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The vulnerability can expose various credentials, including .pypirc, .npmrc, .git-credentials, SSH keys, and token-like environment variables.
To prevent similar issues, ensure that your repositories have strict access controls and consider using automated tools to monitor for unauthorized changes.
The consequences can include unauthorized access to accounts, data breaches, and potential financial loss due to compromised credentials.
Related vulnerabilities
Recent vulnerabilities recorded for memoryos.
