MemTensor npm and PyPI Packages Hit by a Go Worm
An attacker used a Go worm to steal CI publish tokens from MemTensor and ship malicious MemOS packages to npm and PyPI. See how it works, with code and indicators of compromise.
Blog
Follow for the latest updates and insights on
open source security & engineering.
Latest From SafeDep
sckit: A New Go Implant Framework for Supply Chain Worms
sckit is a Go implant framework that steals developer and CI credentials and carries templates to spread through npm, PyPI, and GitHub Actions. Static analysis and indicators of compromise.
Why Does an npm Math Library Need an Encrypted Loader?
A math solver leads to encrypted code in npm packages. Follow the loader, the trigger matrix that unlocks it, the remote access payload, and the full indicators.
OpenAI Agents Turned RubyGems Into a Scraping Proxy
Between May and July 2026, a swarm of AI agents published over 3,000 packages to RubyGems. The gems abused RubyDoc.info documentation builds to run a crawler on someone else's servers, then shipped...
The Agentic IDE Extension Blind Spot
Cursor can install most of the same extensions you had in Visual Studio Code, but not the same versions. Its Import VS Code Configuration step sends only the extension name, never the version. It...
Ship Code.
Not Malware.
Start free with open source tools on your machine. Scale to a unified platform for your organization.
