Cyber Incident Victim: SAP.com
Timeline
Summary
Threat actors linked to TeamPCP compromised four npm packages used in SAP's cloud application development ecosystem—@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt—by injecting malicious preinstall scripts that harvest developer and CI/CD secrets from GitHub, npm, and cloud environments and exfiltrate the data through attacker‑controlled GitHub repositories. The packages, which were quickly removed after publication, contained a multistage payload that encrypts stolen data with a shared RSA key and halts execution on systems configured for the Russian language. Researchers attribute the intrusion to TeamPCP based on similarities with prior supply‑chain campaigns, citing an exposed npm token from a misconfigured CircleCI build in the cloud‑mta‑build‑tool repository as a contributing factor, and note that the same tools and tradecraft were later used against the lightning PyPI package and Intercom's npm package.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Several npm packages for SAP's cloud application development ecosystem have been compromised as TeamPCP's supply chain attacks broaden. The compromised packages went live Wednesday and were quickly spotted by several cybersecurity vendors, including Wiz, Socket, and Aikido Security. Four npm packages for SAP's Cloud Application Programming Model (CAP) and Cloud MTA Build Tool (MBT) were injected with malicious preinstall scripts that execute once the dependency is installed. The poisoned packages are @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The CAP packages are connected to SAP cloud deployment workflows, while the MBT package is used to build deployment-ready multi-target application archive files. The poisoned packages were taken down soon after they were published. Dark Reading contacted SAP for comment on the attacks, but the company did not respond at press time.
The campaign leverages a multistage payload to harvest developer and CI/CD secrets across GitHub, npm, and major cloud providers, and exfiltrates the data via attacker-controlled GitHub repositories. The malware contains hard-coded descriptions for the attacker-controlled repositories: 'A Mini Shai-Hulud has Appeared' is an apparent reference to the Shai-hulud worm attacks that have targeted npm packages since September 2025. The payload includes a second-stage component that terminates before data exfiltration if the system is configured for the Russian language. The attackers use a shared RSA public key to encrypt exfiltrust observed in prior TeamPCP campaigns. Researchers noted that the reference to Shai-hulud is merely a reference and that there is no apparent connection between TeamPCP and the earlier Shai-hulud worm attacks, which dumped secrets in the open whereas this campaign encrypts the stolen data. The attacks were attributed to TeamPCP based on overlapping tradecraft with the group's previous incidents. In past TeamPCP incidents, the threat actors have used the stolen credentials and secrets in one compromised package or open source project to gain access to other packages, creating a cascading series of supply chain attacks.
Socket's research team noted that the four npm packages have meaningful reach across the SAP developer ecosystem, with hundreds of thousands of downloads per week. In addition to the SAP compromise, Socket reported that two other supply chain attacks had hit the lightning PyPI package and Intercom's npm package using the same tools and tradecraft as the Mini Shai-Hulud campaign. The obfuscated JavaScript payload in those attacks contains many similarities to the Shai-hulud attacks, overlapping in targeted tokens, credentials, and obfuscation methods. The broad pattern remains the theft of credentials that can publish software, followed by leveraging the supply chain to reach further victims. Researchers noted that the payload targets GitHub, npm, cloud providers, Kubernetes, CI secrets, and local developer tooling.