sckit Worm State Directory Creation Under .openclaw or .sckit

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects the creation of files or directories under specific paths (/.openclaw/ and /.sckit/) used by the sckit Go-based worm. This worm, distributed via compromised npm and PyPI packages, uses these directories to track state and coordinate execution on infected Linux systems.