#ParsedReport #CompletenessHigh
23-09-2026

sckit: A New Go Implant Framework for Supply Chain Worms

https://safedep.io/sckit-go-implant-framework

Report completeness: High

Threats:
Supply_chain_technique
Sckit_tool
Shai-hulud

Victims:
Software developers, Continuous integration jobs, Npm packages, Python packages, Github actions workflows

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027.013, T1059.006, T1070.004, T1082, T1105, T1195.002, T1528, T1573.001, T1583.001

IOCs:
File: 56
Domain: 7
Hash: 12
Url: 1

Soft:
Linux, macOS, Unix, Node.js, OpenClaw, redis, rabbitmq, Hugging Face, HashiCorp Vault, Slack, have more...

Algorithms:
base64, xchacha20, curve25519, xchacha20-poly1305

Win API:
Prepare, BestEffortCommand, PrepareRemoteRepository, PrepareRemoteRepositoryTarget, HostID, Marshal, Unmarshal, GenerateX25519, SealBound, OpenBound, have more...

Languages:
python

Platforms:
amd64, intel, arm