sckit Go implant spawned by Node.js or Python with stage0 --config64 args

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•4

Detects the execution of the 'sckit' Go-based implant when spawned by Node.js or Python processes using the command-line arguments 'stage0 --config64'. This pattern is associated with malicious npm and PyPI supply chain packages (memtensor) designed to harvest credentials and establish persistence.