Four SAP npm Packages Compromised in TeamPCP-Linked Credential-Theft Attack
Summary
Reports say four SAP npm packages were backdoored to steal developer and CI/CD credentials. Researchers link the attack to TeamPCP with medium confidence; the affected versions were deprecated.
Key points
- The reported affected packages are @cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, @cap-js/db-service 2.10.1, and mbt 1.2.48; the versions were deprecated on npm.
- A malicious preinstall script launched setup.mjs, which downloaded the Bun runtime to execute an obfuscated payload.
- The payload targets npm and GitHub tokens, SSH keys, cloud credentials, Kubernetes secrets, and CI/CD environment secrets.
- On CI runners, the payload reportedly scans process memory for secrets, bypassing CI log masking.
- Stolen data is encrypted and uploaded to public GitHub repositories under victims' accounts; the malware also uses GitHub commit messages as a token dead-drop.
- The malware reportedly attempts to use stolen credentials to modify other packages and repositories and spread further.
- Researchers linked the activity to TeamPCP with medium confidence. A security engineer said an exposed npm token from a misconfigured CircleCI job may have enabled the compromise; SAP had not replied to BleepingComputer.
Article Details
- Victim Organization
- SAP
- Incident Type
- Supply-chain compromise of official npm packages involving a credential-stealing payload
- Data Types Exposed
- npm and GitHub authentication tokens targeted for theft; successful theft or exfiltration is not confirmed
- SSH keys and developer credentials targeted for theft; successful theft or exfiltration is not confirmed
- AWS, Azure, and Google Cloud credentials targeted for theft; successful theft or exfiltration is not confirmed
- Kubernetes configuration and secrets targeted for theft; successful theft or exfiltration is not confirmed
- CI/CD secrets and environment variables targeted for theft; successful theft or exfiltration is not confirmed
- Operational Impact
- Four SAP npm packages were reported compromised and deprecated: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. Their preinstall scripts launched a credential-stealing payload. The payload also attempted to propagate to other packages and repositories. Successful credential theft or further propagation is not confirmed.
- Claim Status
- confirmed
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe execution.js payload was described as heavily obfuscated.T1059.006 · PythonSocket reports that the payload executed an embedded Python script to inspect CI runner memory for secrets.T1059.007 · JavaScriptThe malicious loader used the Bun JavaScript runtime to execute an obfuscated JavaScript payload.T1195.002 · Compromise Software Supply ChainMalicious preinstall scripts were inserted into compromised npm packages, constituting a reported software supply-chain compromise.T1567.001 · Exfiltration to Code RepositoryThe payload reportedly encrypted collected data and uploaded it to public GitHub repositories.
People
Threat Actors
Vendors
Products
BunThe attack used a setup.mjs loader that downloads the Bun runtime to run an obfuscated information-stealer which exfiltrates tokens, SSH keys, cloud and Kubernetes credentials, and memory-scraped CI secrets, thenCloud Application Programming ModelThese packages support SAP’s Cloud Application Programming Model (CAP) and Cloud MTA, which are commonly used in enterprise development.Cloud MTAThese packages support SAP’s Cloud Application Programming Model (CAP) and Cloud MTA, which are commonly used in enterprise development.GitHubSSH keys, cloud and Kubernetes credentials, and memory-scraped CI secrets, then uploads data to public GitHub repos.npmMultiple official SAP npm packages were compromised in an apparent TeamPCP supply-chain attack that inserted a malicious preinstall script to steal developer credentials and CI secrets.