Cybersecurity researchers are sounding the alarm a couple of new provide chain assault marketing campaign focusing on SAP-related npm Packages with credential-stealing malware.
In line with stories from Aikido Safety, SafeDep, Socket, StepSecurity, and Google-owned Wiz, the marketing campaign – calling itself the mini Shai-Hulud – has affected the next packages related to SAP’s JavaScript and cloud utility improvement ecosystem –
- mbt@1.2.48
- @cap-js/db-service@2.10.1
- @cap-js/postgres@2.2.2
- @cap-js/sqlite@2.2.2
“The affected variations launched new installation-time conduct that was not beforehand a part of these packages’ anticipated performance,” Socket mentioned. “The compromised releases added a preinstall script that acts as a runtime bootstrapper, downloading a platform-specific Bun ZIP from GitHub Releases, extracting it, and instantly executing the extracted Bun binary.”
“The implementation additionally follows HTTP redirects with out validating the vacation spot and makes use of PowerShell with -ExecutionPolicy Bypass on Home windows, growing the chance for affected developer and CI/CD environments.”
Wiz famous that the malicious packages match a number of options current in earlier TeamPCP operations, indicating that the identical risk actor is probably going behind the newest marketing campaign.
The suspicious variations had been printed on April 29, 2026, between 09:55 UTC and 12:14 UTC. The poisoned packages introduce a brand new bundle.json preinstall hook that runs a file named “setup.mjs,” which acts as a loader for the Bun JavaScript runtime to execute the credential stealer and propagation framework (“execution.js”).
In line with Aikido, the malware is designed to reap native developer credentials, GitHub and npm tokens, GitHub Actions secrets and techniques, and cloud secrets and techniques from AWS, Azure, GCP, and Kubernetes. The stolen information is encrypted and exfiltrated to public GitHub repositories created on the sufferer’s personal account with the outline “A Mini Shai-Hulud has Appeared.” As of writing, there are greater than 1,100 repositories with descriptions.
As well as, the 11.6 MB payload comes with capabilities to self-propagate by means of developer and launch workflows, particularly utilizing the GitHub and npm tokens to inject a malicious GitHub Actions workflow into the sufferer’s repositories to steal repository secrets and techniques and publish poisoned variations of the npm packages to the registry.
Nonetheless, the newest incident bears vital variations from prior Shai-Hulud waves –
- All exfiltrated information is encrypted with AES-256-GCM and encapsulates the important thing utilizing RSA-4096 with a public key embedded within the payload, successfully making it decipherable solely to the attacker.
- It exists on Russian-locale methods.
- The payload commits itself into each accessible GitHub repository by injecting a “.claude/settings.json” file that abuses Claude Code’s SessionStart hook and a “.vscode/duties.json” file with “runOn”: “folderOpen” setting in order that any try and open the contaminated repository in Microsoft Visible Studio Code (VS Code) or Claude Code causes the malware to be executed.
“This is among the first provide chain assaults to focus on AI coding agent configurations as a persistence and propagation vector,” StepSecurity mentioned.
Additional evaluation into the basis trigger has revealed that the attackers compromised RoshniNaveenaS’s account for the three “@cap-js” packages, adopted by pushing a modified workflow to a non-main department and utilizing the extracted npm OIDC token to publish the malicious packages with out provenance. As for mbt, it is suspected to contain the compromise of the “cloudmtabot” static npm token by means of an as-yet-undetermined channel.
“The cds-dbs staff migrated to npm OIDC trusted publishing in November 2025,” SafeDep mentioned. “Beneath this setup, GitHub Actions can request a short-lived npm token with out storing any long-lived secrets and techniques within the repository. The attacker reproduced this trade manually in a CI step and printed the ensuing token.”
“The important configuration hole: npm’s OIDC trusted writer configuration for @cap-js/sqlite trusted any workflow in cap-js/cds-dbs, not simply the canonical release-please.yml on most important. A department push might trade an OIDC token on behalf of the bundle if the workflow had id-token: write permission and the atmosphere: npm reference.”
In response to the incident, the maintainers of the packages have launched new secure variations that supersede the compromised releases –
