TeamPCP-Linked Supply-Chain Attack Targets SAP CAP and Cloud MTA npm Packages

Apr 29, 2026 · Original article ↗

Summary

Socket analyzed four compromised npm package versions linked to SAP development workflows. Their install scripts deploy a credential-stealing payload that targets developer machines and CI runners, exfiltrates data through GitHub, and can propagate through npm packages.

Key points

Affected versions identified: [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected].
Compromised releases added a preinstall hook that downloads and runs Bun, then executes an obfuscated payload with the privileges of the installing process.
The payload targets developer credentials, cloud and Kubernetes access, environment files, and tokens; on CI runners, it scans process memory for secrets.
Stolen data is encrypted and exfiltrated through GitHub repositories; stolen npm tokens can be used to modify and republish packages.
The payload also installs persistence through Claude Code and VS Code project-opening hooks.
Socket assesses with medium confidence that the campaign is linked to TeamPCP, citing shared code and operational patterns.
Socket advises checking dependency trees and lockfiles, avoiding affected versions, rotating potentially exposed credentials, and reviewing CI/CD logs; @cap-js/[email protected] appeared to have been unpublished.

Article Details

Attack Vectors: Compromised npm package releases added a preinstall hook that downloaded and executed a platform-specific Bun runtime and then ran an obfuscated payload.
The payload harvested developer and CI/CD credentials, including secrets read from CI runner process memory, and exfiltrated encrypted data through GitHub repositories and the GitHub commit-search API.
Using stolen npm tokens, the payload injected itself into packages maintained by victims and published the modified packages.
The payload established persistence through Claude Code session-start and VSCode folder-open hooks.
Defensive Notes: Review dependency trees and lockfiles for [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]; avoid installing these versions.
Verify whether affected packages were installed during the suspected exposure window, and review CI/CD logs for unexpected network activity or binary execution.
Rotate credentials or tokens that may have been exposed in developer or build environments.
Monitor for suspicious access to cloud metadata services from package-installation or JavaScript runtime processes.
Inspect projects for unexpected .claude/settings.json and .vscode/tasks.json files that execute setup scripts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`audit[.]checkmarx[.]cx`	Described as a threat-actor-controlled domain used by prior TeamPCP-linked variants for telemetry.
MD5	`35baf8316645372eea40b91d48acb067`	MD5 of the injected setup.mjs loader, reported as byte-identical across the four affected packages.
SHA256	`4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34`	Hash of the injected setup.mjs loader.
SHA256	`6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95`	Hash of the malicious execution.js payload in the @cap-js/sqlite variant.
SHA256	`80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac`	Hash of a malicious execution.js payload.
SHA256	`eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb`	Hash of a malicious execution.js payload.
URL	`hxxps[:]//api[.]github[.]com/search/commits?q=OhNoWhatsGoingOnWithGitHub&sort=author-date&order=desc&per_page=50`	Specific GitHub commit-search URL identified as the payload's C2 retrieval dead-drop query.