SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack

A recent supply chain attack has compromised SAP-related npm packages by embedding credential-stealing malware within them. This attack, dubbed “Mini Shai-Hulud,” specifically targeted npm packages integral to SAP’s JavaScript and cloud application development environments. Malicious actors inserted installation-time code designed to harvest sensitive developer credentials, including GitHub and npm tokens, GitHub Actions secrets, and cloud credentials spanning AWS, Azure, Google Cloud Platform, and Kubernetes infrastructures.

The threat campaign exploited a configuration vulnerability in npm’s OIDC trusted publishing setup for the affected @cap-js packages, enabling attackers to gain unauthorized access. Notably, the malware utilized AES-256 encryption and leveraged AI coding tools to aid in its distribution, illustrating the growing sophistication of supply chain attacks leveraging emerging technologies. The cybercrime group behind this operation, TeamPCP, has been linked to prior supply chain compromises involving major targets such as Checkmarx, Bitwarden, Telnyx, and Aqua Security’s Trivy.

This incident underscores the critical risks enterprises face stemming from vulnerabilities in developer tools and continuous integration/continuous deployment (CI/CD) pipelines. By compromising developer workstations and trusted package repositories, attackers obtain what amounts to a “master key” to breach software supply chains and cloud infrastructure environments. Organizations using SAP development ecosystems are urged to scrutinize their development workflows, audit npm package dependencies, and strengthen security controls around credential and secret management to mitigate further risk. This attack reaffirms the urgent need for comprehensive supply chain security strategies in the software development lifecycle.