Malicious versions reported for this package
- MAL-2026-16475 — 2.0.34 · Sep 23, 2026
1 result · Feed
-
Unscored —
MemoryOS 2.0.34 was published with a credential-stealing binary
An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/_stage0.py, which launches a bundled …