sckit
Named by 3 kept items in this workspace.
Search every workspace for sckit. It matches the name as written, so it can find other things that share it.
The items that name it 3
Go binary bundled in malicious MemTensor MemOS releases; harvests credentials and secret environment variables and reports to servers under skyleen.fr
Credential-harvesting and self-propagating malware campaign distributed via compromised npm and PyPI packages; campaign IDs 'cloud-openclaw-semi-nuclear' (npm) and 'memos-semi-nuclear' (PyPI).
Stripped, statically linked Go malware binary bundled cross-platform (Linux, macOS, Windows; x64 and arm64) with the compromised packages; searches $HOME for developer secrets and exfiltrates them to C2 servers under skyleen[.]fr; uses configuration schema sckit.runtime.v1; contains strings suggesti
All threat actors in this workspace.