Sckit Worm Credential File Access from Node.js or Python Process

Ibrahim Saud@tektrix

•updated Sep 23, 2026•2•0•6

Detects the Sckit supply chain implant reading sensitive credential files from a user's home directory. The rule monitors processes spawned by Node.js or Python interpreters (the primary loaders for the Sckit worm) attempting to access high-value files like SSH keys, .npmrc, .pypirc, and various token storage files, indicating potential credential harvesting behavior.