Official SAP npm packages compromised in supply-chain attack to steal credentials

Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack, with malicious code designed to steal credentials and authentication tokens from developers' systems. Security researchers at Aikido and Socket report that the compromise impacted four packages supporting SAP's Cloud Application Programming Model and Cloud MTA framework. The affected versions have been deprecated on NPM: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The compromised packages were modified to include a malicious preinstall script that executes automatically when the npm package is installed. The script downloads the Bun JavaScript runtime from GitHub and then runs a heavily obfuscated payload. The payload is an information-stealer that harvests a wide range of credentials from both developer machines and continuous-integration environments, including npm and GitHub authentication tokens, SSH keys, cloud credentials for AWS, Azure, and Google Cloud, Kubernetes configuration and secrets, and CI/CD pipeline secrets and environment variables. On CI runners, the payload uses an embedded Python script that reads process memory for the Runner.Worker process to extract secrets directly from memory, bypassing log masking applied by the CI platform. Once collected, the stolen data is encrypted and uploaded to public GitHub repositories under the victim's account. These repositories include the description, "A Mini Shai-Hulud has Appeared," a string also seen in the earlier Bitwarden supply-chain attack. The malware also searches GitHub commit messages for a specific string and decodes matching messages into tokens, using them to gain further access. Researchers have linked this attack with medium confidence to the TeamPCP threat actors, who used similar code and tactics against Trivy, Checkmarx, and Bitwarden. Security Engineer Adnan Khan reports that an NPM token may have been exposed via a misconfigured CircleCI job, though it remains unclear how the threat actors compromised SAP's npm publishing process. BleepingComputer contacted SAP for comment but did not receive a reply at the time of publication.