Malicious Code Infects SAP NPM Packages in Mini Shai Hulud Attack

Four SAP NPM packages were found injected with malicious code in a supply chain attack dubbed Mini Shai-Hulud. On April 29, four package versions were flagged as malicious: npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm @cap-js/sqlite 2.2.2, which together have over 500,000 weekly downloads. The malicious code used a preinstall script that acted as a runtime bootstrapper, fetching a Bun ZIP from a GitHub repository, extracting it and executing the Bun binary.

According to Onapsis, the malicious versions were available for 2–4 hours before being unpublished, with clean versions released to supersede them. The information stealer targets local credentials, GitHub and NPM tokens, and cloud secrets across AWS, Azure, GCP, GitHub Actions, Kubernetes and other services, exfiltrating via public GitHub repositories bearing the description “A Mini Shai-Hulud has Appeared”; the malware also includes a propagation mechanism.

Wiz attributes the incident to the TeamPCP hacking group, based on a shared RSA key observed in the exfiltration payloads. All organisations using SAP CAP or MTA-based pipelines should check for the affected versions during the exposure window.