sckit Go implant (MemTensor supply-chain worm) binary detection

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects the SCKit Go-based credential-stealing implant found in compromised npm and PyPI packages. The detection logic focuses on unique build-info module paths, specific C2 encryption protocol headers, and embedded campaign identifiers related to 'memos-cloud-openclaw-plugin' and 'MemoryOS' supply chain compromises.