Threat actors are distributing Go-based malware, dubbed ‘sckit,’ through compromised Terraform providers and Go Modules hosted on the HashiCorp Registry. This marks the first documented instance of malicious payloads being distributed via this centralized repository. The affected providers and modules include ‘gocommunity-io/dockerd’ and ‘kreuzwenker/,’ posing a supply chain risk to developers using these components.