Cybersecurity — 2026-05-02

Mini Shai-Hulud Supply Chain Attack Compromises SAP npm Packages Affecting 572K Weekly Downloads

Wiz and Aikido Security reported on April 29 that attackers published trojanized versions of four SAP-related npm packages (mbt, @cap-js/sqlite, @cap-js/postgres, and @cap-js/db-service) via a preinstall hook that fetches the Bun runtime and runs a credential stealer targeting developer and CI/CD secrets. The malware injects .claude/settings.json and .vscode/tasks.json files into accessible victim repositories, causing it to re-execute when opened in Claude Code or VS Code. SecurityWeek reported roughly 1,800 victims; Wiz observed more than 1,100 attacker-created GitHub repositories used for exfiltration. Wiz attributed the campaign with high confidence to TeamPCP, citing a shared RSA public key and the payload's programmed exit on Russian-locale systems, both features present in prior Checkmarx and Bitwarden compromises.

Analysis
The defining feature is persistence: injecting .claude/settings.json and .vscode/tasks.json turns victim repositories into self-reinfecting traps that survive package cleanup and re-execute on any workstation that opens them. TeamPCP's SAP-ecosystem pivot, corroborated across three outlets anchored by Wiz's direct package analysis, places the group at the intersection of enterprise financial systems and CI/CD pipelines, where harvested credentials yield outsized access. The Russian-locale exclusion and shared RSA key supply attribution confidence unusual for this campaign's complexity, though both could represent deliberate borrowing by a separate actor to muddy attribution rather than operational continuity. At least one additional npm supply chain attack targeting enterprise packages will almost certainly be publicly disclosed before August 2026.

3 sources

1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom - SecurityWeek
Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware - Wiz
SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack - The Hacker News