TeamPCP’s ‘Mini Shai Hulud’ Campaign Steals Secrets Through Malicious npm Packages
Summary
Wiz details a TeamPCP-linked campaign that trojanized SAP-related npm packages to steal developer and CI/CD secrets, spread through repositories, and exfiltrate data via GitHub and attacker infrastructure.
Key points
- Malicious versions of four npm packages—@cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, @cap-js/db-service 2.10.1, and mbt 1.2.48—used preinstall scripts to run a dropper and obfuscated payload.
- The malware targeted GitHub and npm tokens, cloud credentials, Kubernetes tokens, GitHub Actions secrets, browser passwords, and secrets in runner memory.
- Stolen data was primarily exfiltrated through encrypted payloads posted to public GitHub repositories; later payloads also used zero[.]masscan[.]cloud and a dynamic GitHub-based fallback.
- The malware could use compromised tokens to propagate and plant files that trigger execution when repositories are opened in Claude Code or VS Code.
- Wiz assessed with high confidence that TeamPCP was responsible, citing a shared RSA public key and overlaps in code and behavior.
- Wiz reported additional trojanized packages—intercom-client 7.0.5 and PyPI lightning 2.6.2 and 2.6.3—with analysis ongoing.
- Security teams should check environments and build artifacts for affected versions and files, rotate potentially exposed credentials, and audit GitHub activity.
Article Details
- Attack Vectors
- Trojanized npm packages used preinstall scripts to run setup.mjs during dependency installation; the dropper downloaded the Bun runtime and executed an obfuscated payload.
- The payload harvested developer and CI/CD credentials, including browser-stored passwords, cloud secrets, Kubernetes tokens, and secrets from GitHub Actions runner memory.
- The malware exfiltrated encrypted data to attacker-controlled GitHub repositories and could search GitHub commits for tokens as a fallback.
- When qualifying GitHub tokens were present but no GitHub personal access token was found, the malware attempted to poison repositories with files configured to execute through Claude Code or VS Code.
- The malware included propagation logic intended to infect additional repositories and package distributions.
- Defensive Notes
- Search environments, lockfiles, artifact stores, and CI logs for affected package versions and the files setup.mjs and execution.js.
- If exposure is suspected, rotate GitHub, npm, cloud, Kubernetes, and CI/CD credentials.
- Audit GitHub activity for suspicious commits, newly created repositories, the propagation keyword, and unusual commit authors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | zero[.]masscan[.]cloud | Dedicated attacker infrastructure used for exfiltration. |
| IPV4 | 94[.]154[.]172[.]43 | Exfiltration endpoint identified in the malware's fallback configuration. |
| MD5 | 00ca0c04d247ef09f2b2acc452029345 | Hash of the malicious Claude Code hooks configuration file .claude/settings.json. |
| MD5 | 04d8a99447b16f6839fff3b978f88d7e | Hash of the trojanized mbt 1.2.48 package tarball. |
| MD5 | 35baf8316645372eea40b91d48acb067 | Hash of the shared malicious setup.mjs dropper included in all four affected packages. |
| MD5 | 45dc9c02f82b4370ca92785282d43a86 | Hash of the malicious execution.js payload in mbt 1.2.48. |
| MD5 | 6fb87d243b011b5445f379f80e1a6b4d | Hash of the malicious execution.js payload in @cap-js/sqlite 2.2.2. |
| MD5 | 8cd683f78735c9bfc32600c73d3d9abe | Hash of the trojanized @cap-js/sqlite 2.2.2 package tarball. |
| MD5 | b523a69b27064d1715d1f0aaffcfae63 | Hash of the malicious execution.js payload in @cap-js/postgres 2.2.2. |
| MD5 | d468f16eafccbc54a994f3d675ace8ae | Hash of the trojanized @cap-js/db-service 2.10.1 package tarball. |
| MD5 | dbb9b09957113463bbeb420c2c4108b5 | Hash of the malicious VS Code task configuration file .vscode/tasks.json. |
| MD5 | e32eaf0c3cde9616831a1e92d42b0058 | Hash of the trojanized @cap-js/postgres 2.2.2 package tarball. |
| SHA1 | 0af7415d65753f6aede8c9c0f39be478666b9c12 | Hash of the trojanized mbt 1.2.48 package tarball. |
| SHA1 | 307d0fa7407d40e67d14e9d5a4c61ac5b4f20431 | Hash of the shared malicious setup.mjs dropper included in all four affected packages. |
| SHA1 | 4b04304f6d51392e3f43856c94ca95800518a694 | Hash of the trojanized @cap-js/db-service 2.10.1 package tarball. |
| SHA1 | 6bc859aaee1f8885eec2a3016226e877e5adba08 | Hash of the malicious execution.js payload in mbt 1.2.48. |
| SHA1 | 7b0278216ac31ec18eca9eb8bc1c1261a1b26f6c | Hash of the malicious VS Code task configuration file .vscode/tasks.json. |
| SHA1 | 7b6a28e92149637e5d7c7f4a2d3e54acd507c929 | Hash of the trojanized @cap-js/sqlite 2.2.2 package tarball. |
| SHA1 | bc95cc5dda788295aa0c9456791520599ef99526 | Hash of the malicious execution.js payload in @cap-js/sqlite 2.2.2. |
| SHA1 | ca4a5bb85778ffcd2153ace88fe2d882c8ceeb23 | Hash of the malicious execution.js payload in @cap-js/postgres 2.2.2. |
| SHA1 | e80824a19f48d778a746571bb15279b5679fd61c | Hash of the trojanized @cap-js/postgres 2.2.2 package tarball. |
| SHA1 | ff7ed7a0fa1c43eed01809d076feedbaed464fc7 | Hash of the malicious Claude Code hooks configuration file .claude/settings.json. |
| SHA256 | 14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128 | Hash of the malicious Claude Code hooks configuration file .claude/settings.json. |
| SHA256 | 1d9e4ece8e13c8eaf94cb858470d1bd8f81bb58f62583552303774fa1579edee | Hash of the trojanized @cap-js/postgres 2.2.2 package tarball. |
| SHA256 | 258257560fe2f1c2cc3924eae40718c829085b52ae3436b4e46d2565f6996271 | Hash of the trojanized @cap-js/db-service 2.10.1 package tarball. |
| SHA256 | 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 | Hash of the shared malicious setup.mjs dropper included in all four affected packages. |
| SHA256 | 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95 | Hash of the malicious execution.js payload in @cap-js/sqlite 2.2.2. |
| SHA256 | 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac | Hash of the malicious execution.js payload in mbt 1.2.48. |
| SHA256 | 86282ebcd3bebf50f087f2c6b00c62caa667cdcb53558033d85acd39e3d88b41 | Hash of the trojanized mbt 1.2.48 package tarball. |
| SHA256 | 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f | Hash of the malicious VS Code task configuration file .vscode/tasks.json. |
| SHA256 | a1da198bb4e883d077a0e13351bf2c3acdea10497152292e873d79d4f7420211 | Hash of the trojanized @cap-js/sqlite 2.2.2 package tarball. |
| SHA256 | eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb | Hash of the malicious execution.js payload in @cap-js/postgres 2.2.2. |
MITRE ATT&CK
T1059.007 · JavaScriptPackage preinstall scripts and the setup.mjs dropper executed the JavaScript payload.T1195.002 · Compromise Software Supply ChainThe operators trojanized legitimate npm packages by adding malicious preinstall scripts.T1555.003 · Credentials from Web BrowsersThe malware stole credentials and passwords from Chrome, Safari, Edge, Brave, and Chromium.T1567.001 · Exfiltration to Code RepositoryThe malware exfiltrated encrypted secrets through public GitHub repositories.
Threat Actors
Malware
Vendors
Products
BraveThe SAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previousChromiumSAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previousClaude Codeare). The below files are placed in the repo, in an attempt to infect users who open the repo in Claude Code or VSCode:EdgeThe SAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previousGitHubshows an evolution in both exfiltration and credential harvesting techniques. In addition to earlier GitHub-based exfiltration, the malware now leverages dedicated infrastructure, primarily the domainGoogle ChromeThe SAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previousHashiCorp Vaultpackage further expands capabilities by actively scanning for secrets in Kubernetes environments and HashiCorp Vault. It queries Kubernetes service endpoints and Vault configurations, using extensive regex-basedKubernetesfound in the intercom-client package further expands capabilities by actively scanning for secrets in Kubernetes environments and HashiCorp Vault. It queries Kubernetes service endpoints and Vault configurations,npmNPM Package: intercom-client@7.0.5SafariThe SAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previousVS Code.vscode/tasks.json VS Code task configuration VS Code task "Environment Setup" — runs node .claude/setup.mjs on folder open (runOn: folderOpen) SHA256: 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f