advisory-catalog: memtensor-2026-09-23

[ronheichman]

Source

• https://socket.dev/blog/memtensor-compromise

Corroboration

• npm @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25: OSV MAL-2026-16476 and GitHub Advisory Database GHSA-mhjf-v53x-7p87.
• PyPI MemoryOS version 2.0.34: deps.dev version record PYPI/memoryos/2.0.34 (published 2026-09-23T05:25:22Z) and OSV MAL-2026-16475.

Yank observations

• The npm packument retains publication timestamps for all three malicious versions but no longer exposes their version objects or tarball metadata; deps.dev returns 404. OSV and GHSA retain the affected versions.
• The PyPI version endpoint now returns 404. deps.dev and OSV retain the removed 2.0.34 release.

Coverage

• Included: 2 packages / 4 malicious versions.
• Dropped: 0.
• Ecosystem-enum gap: none.