Mini Shai-Hulud Supply-Chain Attack Targets SAP npm Packages
Summary
Researchers say four SAP-related npm versions in the Mini Shai-Hulud campaign delivered an information stealer targeting developer and cloud credentials. The versions were exposed for 2–4 hours, then unpublished and replaced.
Key points
- On April 29, four versions were flagged as malicious: mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, and @cap-js/sqlite 2.2.2.
- The affected packages support SAP CAP and cloud deployment workflows and have more than 500,000 combined weekly downloads.
- The packages' preinstall script reportedly fetched and ran a Bun binary.
- The information stealer targeted local credentials, GitHub and npm tokens, and cloud secrets; the article says stolen data was exfiltrated through public GitHub repositories.
- Aikido says the malware could propagate by modifying and republishing package tarballs using stolen GitHub Actions tokens.
- Onapsis says the malicious versions were available for 2–4 hours; they have since been unpublished and clean versions released. Organizations are advised to check whether they installed them during that window.
- Wiz attributes the incident to TeamPCP based on a shared RSA public key and operational patterns; the article says a compromised npm token exposed to CircleCI pull-request builds may have enabled the initial compromise.
Article Details
- Event Type
- Supply-chain attack involving malicious SAP-related NPM package versions.
- Impact
- Four package versions were injected with malicious code and were available for 2–4 hours before being unpublished and superseded by clean versions. The code stole local credentials, GitHub and NPM tokens, and cloud-related secrets, then exfiltrated them through public GitHub repositories. It also attempted to propagate by modifying package tarballs and publishing them with stolen GitHub Actions tokens. The packages had more than 500,000 combined weekly downloads; the article does not report how many systems or organizations were actually affected.
MITRE ATT&CK
Threat Actors
Vendors
CircleCISAP’s NPM ecosystem was likely hit through a compromised NPM token that was exposed to pull request builds via CircleCI, Aikido says.GitHubWhen executed, the script fetches a Bun ZIP from a GitHub repository, extracts it, and executes the included Bun binary.npmFour SAP NPM packages have been injected with malicious code as part of a new supply chain attack, security researchers warn.SAPFour SAP NPM packages have been injected with malicious code as part of a new supply chain attack, security researchers warn.
Products
@cap-js/db-serviceOn April 29, four package versions were flagged as malicious, namely npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm @cap-js/sqlite 2.2.2.@cap-js/postgresOn April 29, four package versions were flagged as malicious, namely npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm @cap-js/sqlite 2.2.2.@cap-js/sqliteOn April 29, four package versions were flagged as malicious, namely npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm @cap-js/sqlite 2.2.2.GitHub ActionsAccording to Aikido, the threat checks for GitHub Actions release workflows and then modifies package tarballs to add the payload, modify their versions, repackage them, and use stolen GitHub Actions tokens to publishmbtOn April 29, four package versions were flagged as malicious, namely npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm @cap-js/sqlite 2.2.2.SAP Business Technology PlatformAll organizations using SAP Business Technology Platform workflows, SAP CAP, or MTA-based deployment pipelines should check if they installed the malicious package versions during the exposure window.SAP Cloud Application Programming ModelThe campaign, referred to as Mini Shai-Hulud, is targeting packages linked to the SAP Cloud Application Programming (CAP) ecosystem and SAP cloud deployment workflows.