cyber.hendryadrian.com
Threat Research · thehackernews.com

Mini Shai-Hulud Campaign Uses Compromised SAP-Related npm Packages to Steal Credentials

· Original article ↗

Summary

A campaign dubbed mini Shai-Hulud compromised four SAP-related npm releases, using a Bun-based payload to steal developer and cloud credentials, exfiltrate them to GitHub, and spread through GitHub Actions and AI/IDE hooks.

Key points

  • The compromised releases were [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected].
  • A preinstall hook runs setup.mjs, which downloads a Bun runtime and executes the credential-stealing payload, execution.js.
  • The payload targets developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets from AWS, Azure, GCP, and Kubernetes.
  • Stolen data is encrypted and sent to public GitHub repositories created under victims’ own accounts.
  • The malware can spread by injecting GitHub Actions workflows and publishing poisoned npm package versions; Claude Code and VS Code hooks are also used to trigger execution when repositories are opened.
  • Researchers attributed the @cap-js package compromise to a maintainer account compromise and an overly broad npm OIDC trust configuration; the cause of the mbt compromise remains undetermined.
  • Package maintainers released safe versions that supersede the compromised releases.

Article Details

Attack Vectors
  • Compromised releases of four SAP-related npm packages added a preinstall hook that downloaded a Bun runtime and executed a credential-stealing payload.
  • The payload harvested developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets, then encrypted and exfiltrated the data to public GitHub repositories under victims’ accounts.
  • Using stolen GitHub and npm tokens, the malware injected GitHub Actions workflows into repositories to steal repository secrets and publish poisoned npm package versions.
  • The malware added Claude Code SessionStart and VS Code folder-open hooks to repositories to trigger execution when they were opened.
Defensive Notes
  • Package maintainers released safe versions that supersede the compromised releases; the article does not specify those version numbers.
  • Review npm OIDC trusted-publisher settings so publishing is restricted to the intended canonical workflow and branch, rather than any workflow in the repository.
  • Review GitHub Actions workflows and repository contents for unauthorized changes, including injected workflows and AI/IDE configuration hooks.

MITRE ATT&CK

T1059.001 · PowerShellOn Windows, the package implementation used PowerShell with -ExecutionPolicy Bypass.T1059.007 · JavaScriptThe preinstall loader downloaded Bun and used it to execute the JavaScript credential stealer.T1105 · Ingress Tool TransferThe preinstall script downloaded a platform-specific Bun ZIP from GitHub Releases.T1195.002 · Compromise Software Supply ChainAttackers poisoned SAP-related npm package releases by adding a malicious preinstall hook.T1546 · Event Triggered ExecutionThe payload added Claude Code SessionStart and VS Code folder-open hooks that triggered execution when an infected repository was opened.T1567.001 · Exfiltration to Code RepositoryThe malware encrypted stolen data and exfiltrated it to public GitHub repositories created on victims’ accounts.

Threat Actors

TeamPCPWiz reported that features shared with prior TeamPCP operations indicate the group is likely behind this campaign; the attribution is not presented as confirmed.

Products

AWSThe malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets (AWS, Azure, GCP, Kubernetes), then encrypts and exfiltrates them to public GitHub repos.AzureThe malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets (AWS, Azure, GCP, Kubernetes), then encrypts and exfiltrates them to public GitHub repos.Bun@cap-js/[email protected], @cap-js/[email protected]) by adding a preinstall hook that downloads and executes a Bun-based credential stealer.Claude CodeIt self-propagates by injecting malicious GitHub Actions workflows and abusing AI/IDE hooks (.claude/settings.json and .vscode/tasks.json) to trigger on Claude Code and VS Code openings.GCPThe malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets (AWS, Azure, GCP, Kubernetes), then encrypts and exfiltrates them to public GitHub repos.GitHub ActionsThe malware harvests developer, GitHub, npm, and cloud secrets, encrypts and exfiltrates them to victim-owned GitHub repositories, and self-propagates via injected GitHub Actions and AI/IDE hooks to persist and spread.KubernetesThe malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets (AWS, Azure, GCP, Kubernetes), then encrypts and exfiltrates them to public GitHub repos.npmresearchers warn of a supply chain campaign called “mini Shai-Hulud” that poisoned SAP-related npm packages ([email protected], @cap-js/[email protected], @cap-js/[email protected], @cap-js/[email protected]) by adding aVS CodeIt self-propagates by injecting malicious GitHub Actions workflows and abusing AI/IDE hooks (.claude/settings.json and .vscode/tasks.json) to trigger on Claude Code and VS Code openings.

Related Articles