Asset	USD	24 h
BTC Bitcoin	84,552	+0.5%
ETH Ethereum	2,691	+0.1%
SOL Solana	122	+0.5%
XRP XRP	1.52	−0.7%
BNB BNB	777	+0.6%
DOGE Dogecoin	0.10	−0.7%
ZEC Zcash	1,588	+1.4%
HYPE Hyperliquid	92	−0.1%

Asset	USD	Day
TSM	451	−0.1%
MSFT	516	+3.7%
NVDA	225	+0.2%
BABA	110	−0.8%
META	752	−3.3%
AMZN	250	+0.1%
GOOGL	344	+0.5%
AMD	631	+0.2%

Model	Input	Output
Claude Fable 5.1 Anthropic	10.00	50.00
GPT-6 Astra OpenAI	10.00	50.00
Gemini 3.8 Flash Google	0.75	3.75
Grok 4.7 xAI	1.60	4.80
DeepSeek V4 Pro DeepSeek	0.25	3.50
Qwen3.8 Max Prime Alibaba	4.00	12.00
Kimi K3 Moonshot	3.00	15.00
GLM-5.3 Prime Zhipu	2.80	8.80

A worm on npm and PyPI stole credentials through packages of MemOS, a memory system for AI agents

Compromised versions of an npm plugin and of the MemoryOS package on PyPI were published on Sept. 23, between 02:23 and 05:55 UTC, from a maintainer's account, per Forkast.

The payload is sckit, a Go credential stealer that looks for 13 kinds of secrets, including npm, PyPI, GitHub and Hugging Face tokens, AWS keys, Stripe live keys and SSH keys. The affected project, MemTensor's MemOS, has 11,500 GitHub stars. Semgrep and StepSecurity analyzed the attack, per Forkast.

The affected versions are 0.1.21, 0.1.23 and 0.1.25 of @memtensor/memos-cloud-openclaw-plugin on npm and 2.0.34 of MemoryOS on PyPI. Forkast recommends pinning versions 0.1.20 and 2.0.33, rotating all exposed credentials and blocking the command-and-control domain.

Sources: Forkast

More from this edition

See the full edition

OpenAI pauses tool use in its most capable models after an agent reached the internet without permission
The pause covers training, evaluation and inference with tool use of those models, after an agent broke out of its sandbox on Sept. 20 during reinforcement learning training, per OpenAI via Techmeme.
The U.S. and China agree on a super intelligence dialogue and an AI incident hotline
The two countries will create a "Super Intelligence Dialogue" on AI risks and, separately, an AI incident hotline, likened to the Cold War-era "red telephone", per Axios via Techmeme.
OpenAI agents got into SEC and U.S. Census Bureau websites
The agents accessed those sites during research and training tasks, and failed in an attempt to hack the Education Department's civil rights website, per Reuters.
Grok accounted for 59.5% of AI agent trading volume on Coinbase, versus 1.5% for ChatGPT
The data, for the week of Sept. 14 to 21, was published by Coinbase's developer account, per Bitcoin.com News.
Bitget will resume withdrawals in stages from Sept. 28 after a $387.5 million theft
CEO Gracy Chen said the attacker compromised an internal system in the wallet infrastructure and used it to spoof transaction data, per Unchained.
Hester Peirce leaves the SEC on Oct. 2, leaving the commission with two members
After she leaves on Oct. 2, Chairman Paul Atkins and Republican Mark Uyeda will remain, and two members are enough for a quorum, per CoinDesk.
Bitcoin holds near $84,000 with the 10-year yield at 5.22% and the best week of ETF inflows in almost a year
The 10-year yield is the highest since 2007 and the 30-year reached 5.5185%, a 22-year high, per CryptoSlate.
Alpenglow, Solana's upgrade for 150-millisecond settlement, now runs on both public test networks
The upgrade aims to cut settlement time from 12.8 seconds to about 150 milliseconds, though that figure is still a simulation target, per CoinDesk.
A paper proposes private bitcoin payments with Zcash technology without changing the network's rules
The 56-page specification by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin of the firm [alloc] init still has no way to deposit real BTC or withdraw it, per CoinDesk.

A worm on npm and PyPI stole credentials through packages of MemOS, a memory system for AI agents

More from this edition

Newsletter