Topic

Supply Chain Attack

Coverage tagged supply chain attack.

Articles: 2
Desks: 2

Data graphic: a timeline of 23 September 2026 UTC headlined "MemTensor's own CI shipped a worm". After an attacker branch was pushed and deleted five times between 00:48 and 02:03, malicious npm releases 0.1.21 02:23 , 0.1.23 03:49 and 0.1.25 04:36 alternate with clean 0.1.22 03:45 and 0.1.24 04:33 , issue #173 opens at 04:17, and PyPI MemoryOS 2.0.34 follows at 05:25: four poisoned releases, all carrying the sckit worm. Pin 0.1.20 and 2.0.33.

MemTensor's OpenClaw Plugin and MemoryOS Shipped the sckit Credential Worm

Pushed commits made MemTensor's own GitHub Actions jobs leak npm and PyPI tokens. Four releases then shipped sckit, a Go worm that steals developer secrets.

Oct 2 · 8 min

Technical conceptual diagram illustrating security attack vectors across open-weight model files and cloud API integrations.

stableResearch Supply Chain Attack

AI Supply Chain Security Risks: How OpenAI Integrations and Hugging Face Flaws Expose Enterprise Infrastructure

Hugging Face flaws and OpenAI integration paths have produced remote code execution, secret harvesting and cross-tenant exfiltration in real deployments.

Jul 24 · 6 min