{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/cloud-application-programming-model-cap/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["TeamPCP"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Cloud Application Programming Model (CAP)","Cloud MTA"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","credential-theft","npm"],"_cs_type":"threat","_cs_vendors":["SAP"],"content_html":"\u003cp\u003eOn April 29, 2026, security researchers discovered that multiple official SAP npm packages were compromised in a supply-chain attack, suspected to be carried out by TeamPCP. The compromised packages, including \u003ccode\u003e@cap-js/sqlite\u003c/code\u003e (v2.2.2), \u003ccode\u003e@cap-js/postgres\u003c/code\u003e (v2.2.2), \u003ccode\u003e@cap-js/db-service\u003c/code\u003e (v2.10.1), and \u003ccode\u003embt\u003c/code\u003e (v1.2.48), support SAP\u0026rsquo;s Cloud Application Programming Model (CAP) and Cloud MTA, commonly used in enterprise development. The attack involves injecting a malicious \u0026lsquo;preinstall\u0026rsquo; script into these packages, which executes automatically during installation. This script downloads and executes a heavily obfuscated JavaScript payload designed to steal sensitive credentials from developer machines and CI/CD environments. This incident highlights the ongoing risk of supply chain attacks targeting widely used development tools.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Compromise:\u003c/strong\u003e Threat actors compromise official SAP npm packages (\u003ccode\u003e@cap-js/sqlite\u003c/code\u003e, \u003ccode\u003e@cap-js/postgres\u003c/code\u003e, \u003ccode\u003e@cap-js/db-service\u003c/code\u003e, \u003ccode\u003embt\u003c/code\u003e). The exact method of initial compromise is currently unknown, but a misconfigured CircleCI job is suspected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePackage Modification:\u003c/strong\u003e The compromised npm packages are modified to include a malicious \u0026lsquo;preinstall\u0026rsquo; script.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInstallation Trigger:\u003c/strong\u003e When developers install the compromised packages using \u003ccode\u003enpm install\u003c/code\u003e, the \u0026lsquo;preinstall\u0026rsquo; script executes automatically.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Download:\u003c/strong\u003e The \u0026lsquo;preinstall\u0026rsquo; script launches a loader named \u003ccode\u003esetup.mjs\u003c/code\u003e that downloads the Bun JavaScript runtime from GitHub.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution of Information Stealer:\u003c/strong\u003e The Bun runtime is used to execute a heavily obfuscated \u003ccode\u003eexecution.js\u003c/code\u003e payload, which acts as an information stealer.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Theft:\u003c/strong\u003e The information stealer targets a wide variety of credentials, including npm and GitHub authentication tokens, SSH keys, cloud credentials for AWS, Azure, and Google Cloud, Kubernetes configurations and secrets, and CI/CD pipeline secrets and environment variables.  It also attempts to extract secrets directly from the CI runner\u0026rsquo;s memory by scanning \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/maps\u003c/code\u003e and \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/mem\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration:\u003c/strong\u003e The stolen data is encrypted and uploaded to public GitHub repositories under the victim\u0026rsquo;s account. These repositories include the description \u0026ldquo;A Mini Shai-Hulud has Appeared\u0026rdquo;.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement:\u003c/strong\u003e The malware searches GitHub commits for the string \u003ccode\u003eOhNoWhatsGoingOnWithGitHub:\u0026lt;base64\u0026gt;\u003c/code\u003e, decoding matching commit messages into GitHub tokens to gain further access and propagate to other packages and repositories, injecting the same malicious code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis supply chain attack can lead to the theft of sensitive credentials, allowing attackers to gain unauthorized access to internal systems, cloud infrastructure, and source code repositories. The compromised credentials and secrets can be used for lateral movement within the victim\u0026rsquo;s network, data exfiltration, and further supply chain attacks. The use of stolen credentials to modify other packages increases the scope of the attack, potentially impacting a large number of developers and organizations using the compromised SAP packages.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor npm package installations for the presence of \u003ccode\u003epreinstall\u003c/code\u003e scripts executing unusual processes, such as the execution of \u003ccode\u003esetup.mjs\u003c/code\u003e or the download of the Bun JavaScript runtime from GitHub; implement the \u003ccode\u003eDetect Suspicious NPM Package Preinstall Script\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003cli\u003eImplement the \u003ccode\u003eDetect GitHub Repository Creation with \u0026quot;A Mini Shai-Hulud has Appeared\u0026quot; Description\u003c/code\u003e Sigma rule to detect exfiltration attempts via public GitHub repositories.\u003c/li\u003e\n\u003cli\u003eAudit CI/CD pipeline configurations and restrict access to sensitive credentials and secrets to prevent exposure via misconfigured jobs; remediate the reported CircleCI misconfiguration.\u003c/li\u003e\n\u003cli\u003eMonitor process memory for credential harvesting activity targeting Runner processes in CI/CD environments, specifically looking for reads of \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/maps\u003c/code\u003e and \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/mem\u003c/code\u003e as outlined in the overview.\u003c/li\u003e\n\u003cli\u003eDeprecate and remove the compromised packages \u003ccode\u003e@cap-js/sqlite\u003c/code\u003e (v2.2.2), \u003ccode\u003e@cap-js/postgres\u003c/code\u003e (v2.2.2), \u003ccode\u003e@cap-js/db-service\u003c/code\u003e (v2.10.1), and \u003ccode\u003embt\u003c/code\u003e (v1.2.48) from your development and CI/CD environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-29T22:43:44Z","date_published":"2026-04-29T22:43:44Z","id":"/briefs/2026-04-sap-npm-compromise/","summary":"Multiple official SAP npm packages were compromised via a supply chain attack, likely by TeamPCP, to steal credentials and authentication tokens from developers' systems.","title":"Compromised SAP npm Packages Steal Developer Credentials","url":"https://feed.craftedsignal.io/briefs/2026-04-sap-npm-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed — Cloud Application Programming Model (CAP)","version":"https://jsonfeed.org/version/1.1"}