Compromised SAP npm Packages Found Harvesting Developer and CI/CD Secrets

Security researchers have identified a severe supply chain attack targeting the SAP developer ecosystem. A threat group identified as TeamPCP has compromised multiple legitimate SAP npm packages in a new campaign named Mini Shai Hulud.

The operation relies on injecting malicious pre-install scripts that execute silently during dependency installation.

By leveraging a multi-stage payload, the attackers are aggressively harvesting developer credentials and CI/CD secrets while employing advanced propagation techniques to infect additional repositories.

Infection Mechanism and Credential Theft

The attackers created malicious versions of widely used SAP packages, including @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt.

They modified these libraries to include a pre-install script that automatically triggers a dropper file named setup.mjs when developers run standard npm install commands.

This dropper bypasses typical execution flows by downloading the Bun JavaScript runtime to launch a massive, highly obfuscated payload named execution.js before the package installation even finishes.

Upon execution, the malware acts as a comprehensive credential stealer. It targets developer environments and CI/CD pipelines to collect GitHub tokens, npm credentials, Kubernetes access tokens, and cloud secrets from AWS, Azure, and Google Cloud Platform.

The threat actors even use advanced memory-extraction techniques to extract secrets directly from runner environments. Interestingly, the malware performs an initial system check for Russian language configurations.

If the system locale or environment variables start with a Russian identifier, the payload terminates immediately to prevent data collection from Russian-speaking users.

Stolen information is encrypted with an RSA public key and exfiltrated to attacker-controlled public GitHub repositories via the GraphQL API, as reported by WIZ.

Browser Targeting and GitHub Poisoning

This campaign introduces notable tactical evolutions for TeamPCP. For the first time, their malware includes capabilities to steal passwords directly from popular web browsers such as Chrome, Safari, Edge, and Brave.

If the primary credential collection fails to find personal access tokens, the malware initiates a fallback propagation routine designed to poison the local GitHub repository. The attackers drop hidden configuration files tailored for modern development tools.

For users of Claude Code, the malware creates specific hook configurations that run the dropper on every new session. For Visual Studio Code users, a customized task configuration executes the payload immediately whenever a project folder is opened.

Security teams are urged to immediately search artifact stores, lockfiles, and CI logs for the affected package versions and associated malicious files.

Organizations should rotate all potentially exposed GitHub tokens, cloud credentials, and CI/CD secrets, and actively monitor GitHub activity for unauthorized commits or anomalous repository activity.

Indicators of Compromise

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.