sckit TLS Fallback CA Bundle File Creation in .sckit Directory

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects the creation of a 'ca-roots.pem' file within a hidden '.sckit' directory on Linux systems. This behavior is associated with the 'sckit' supply-chain malware (e.g., delivered via malicious npm packages like @memtensor/memos-cloud-openclaw-plugin), which uses this bundled certificate to enable HTTPS Command and Control (C2) communication in environments where standard system CA stores are unavailable.