MemoryOS Supply Chain Attack

• MemTensor / MemoryOS PyPI package hijacked via a malicious build backend
• TinyMongo
• Jev: what to know
• One innocent dict read makes attribute access permanently slower
• Extras
• Joke

About the show

Sponsored by us! Support our work through:

• Our courses at Talk Python
• Consulting from Six Feet Up

Connect with the hosts

• Michael: Mastodon / BlueSky / X / LinkedIn
• Calvin: Mastodon / BlueSky / X / LinkedIn
• Show: Mastodon / BlueSky / X

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Calvin #1: MemTensor / MemoryOS PyPI package hijacked via a malicious build backend

• On Sept 23 an attacker published backdoored MemoryOS 2.0.34 on PyPI and three bad versions (0.1.21, 0.1.23, 0.1.25) of MemTensor's OpenClaw plugin on npm. PyPI had no clean release that day, so 2.0.34 was the newest.
• They pushed commits to MemTensor's own GitHub Actions release pipelines. On PyPI that was a custom Poetry build backend, and on npm a tweaked validation script. Both used BASH_ENV to hand the publish token to the attacker before the real publish ran. SafeDep couldn't confirm how the attacker got push access.
• Runs on import, not install: A Go implant called sckit starts when the library loads, so --ignore-scripts won't save you.
• It harvests credentials from your home directory (npm and PyPI tokens, GitHub tokens, SSH keys, cloud CLI tokens, .env files) and sends them to skyleen[.]fr servers.
• It's a worm: It uses stolen tokens to copy itself into other repos and packages, so the victim list could grow.
• If you installed it: Downgrade to MemoryOS 2.0.33 (plugin 0.1.20) and rotate every credential reachable from $HOME. Also kill any running sckit stage0 process and check repos you can push to for a stray runtime-update.yml workflow or .sckit/ directory.

Michael #2: TinyMongo

• Want to use a MongoDB data interface, but swap out the storage engine?
  • Memory for testing/caching
  • JSON/TinyDB simple JSON files
  • SQLite for durable, high-perf reads with WAL
  • SQLIte shared for high write apps
  • DuckDB + Parquet for analytics apps
  • Postgres + MariaDB for multi-machine client/server
• Great for teaching, examples, and simple deployments
• Amazing story of paired AI development
  • Will completely run talkpython.fm after weeks of shared work together (in SQLite mode).

Calvin #3: Jev: what to know

• What it is: Jev is a model from TypeSafe AI that answers with typed results (yes/no probabilities, scores, picks from your options) instead of prose. Real Python published a hands-on tutorial on 2026-09-24 and the buzz on hacker news is almost deafening.
• It's proprietary: Jev is a hosted, closed-weight model. There are no weights to download and no self-hosting. Everything called "open Jev" is an independent reimplementation, not TypeSafe's model.
• Your data leaves your machine: Every call sends your input text to a third-party API. In the tutorial that path goes through OpenRouter to TypeSafe. Think twice before sending customer messages, tickets or anything sensitive.
• Cost and stability are open questions: The tutorial calls Jev "cheap, but not free" and says it's fast and cheap "at the moment." It also says whether that stays true is "something to keep an eye on."
• Credit to Real Python: It's a good, practical intro. It shows the Noul, Score and Choice primitives, and its point that instruction wording matters more than thresholds is useful advice for any model. The tutorial itself says similar results are possible with a well-prompted LLM.
• Open options to look at instead:
  • JevK5 (https://github.com/allebee/jevk5): Apache-2.0 weights and code, 4B or 9B parameters, and it accepts TypeSafe-style requests.
  • SemIf, formerly OpenJev (https://github.com/TheoLeeCJ/openjev): MIT-licensed, small models, and it can run CPU-only.
  • openjev-sglang (https://github.com/ekzhang/openjev-sglang): a Jev-compatible endpoint running Qwen3.6-35B-A3B, but no license is stated, so check before commercial use.
• The catch: These copy Jev's interface, not its model or training. Results will differ, and I haven't run any of them. Benchmarks are self-reported, and JevK5 is English-only.

Michael #4: One innocent dict read makes attribute access permanently slower

Timofei Ivankov benchmarks a CPython internals surprise: since 3.11, attribute access skips the instance dict entirely. A specialized opcode reads the attri.bute at a fixed byte offset in the object's inline values array. Read obj.__dict__ once, though, and the dict gets materialized, the object loses that specialized path for the rest of its life, and a million-iteration loop goes from 33 ms to 51 ms on CPython 3.14. vars() and copy.copy() trigger the same thing, so a debugging print or a shallow copy in code touching your hot objects quietly makes every later attribute access roughly 1.5x slower.

• The slowdown is permanent and nothing about it looks like a performance decision: ordinary code far from the hot loop can trigger it, and the function that gets slower never changes.
• Materializing dict produces a split table, and the LOAD_ATTR_WITH_HINT fallback declines split tables, so the object ends up with no specialization at all
• vars(), 'x' in o.dict, and copy.copy() all materialize it; copy.copy is the realistic trap since nobody treats a shallow copy as a performance decision
• slots instances read attributes at exactly the same speed and cannot fall into the trap since there is no dict to materialize
• On the free-threaded build both effects grow: atomic incref on reads plus an object lock on writes push the penalty from 17.6 to 25.4 ns
• Credit: this item was surfaced by the PyCoder's Weekly newsletter

Extras

Calvin:

• whatsnewt - a TUI text adventure through what's new in Python 3.15; playful but niche.

Joke: Shipping a button in 2026…