SAP Build Packages Turn Install Time Into Theft Time
A trusted dependency can become an execution point before your build ever starts. In this campaign, the danger is not just a bad package version. It is that a preinstall script can pull in Bun and run a credential stealer during dependency installation, before normal package integrity checks help you.
Researchers say TeamPCP’s “Mini Shai-Hulud” campaign hit SAP CAP-related npm packages and spread to other ecosystems. The affected releases include mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, @cap-js/sqlite@2.2.2, intercom-client@7.0.4 and 7.0.5, and lightning@2.6.2 and 2.6.3 on PyPI. The malware targets developer and CI/CD secrets, including GitHub, npm, cloud, and Kubernetes credentials, and uses compromised tokens to propagate.
The forward risk is broader than the initial package set. Any pipeline that installs these dependencies may have exposed tokens already, and those secrets can outlive the package cleanup if they were reused elsewhere.