Novel supplychain.local Go worm appears

A supply-chain worm (tracked as supplychain.local) was published to npm and PyPI packages (@memtensor/memos-cloud-openclaw-plugin and MemoryOS) delivering a multiplatform Go binary that executes via language-native droppers, steals publishing/CI credentials, and attempts to self-propagate through direct package publishing and compromised GitHub Actions; the report includes decoded configuration, loader stubs, C2 domains/IP, and sckit binary hashes as indicators of compromise.