- Engineer — Act: Multi-source corroboration (Aikido, SafeDep, Socket, StepSecurity) of an active supply-chain compromise in npm and PyPI — a direct Act signal per channel criteria. Audit your dependency trees for @memtensor/memos-cloud-openclaw-plugin and any related MemTensor packages; remove or pin away from affected versions and rotate credentials on any systems where compromised versions were installed or executed.
- SOC/IR — Act: Active credential-stealing implant with cross-platform reach on developer and CI/CD systems warrants an immediate sweep. Hunt for sckit process artifacts and anomalous outbound connections from build environments and developer endpoints since the affected package versions were published; prioritize Linux and macOS systems alongside Windows given the cross-platform Go implant.
- Leader — Plan: A corroborated supply-chain compromise delivering a credential stealer could expose internal secrets or customer data if engineering teams pulled the affected packages. Confirm whether MemTensor packages appear in any internal dependency inventories and request a scope assessment from your engineering leads this week before this surfaces as a customer security question.