SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer — Threadlinqs Intelligence
As of 2026-05-30, SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0439 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
On 2026-04-29, four official SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite) — with ~570K combined weekly downloads — were trojanized with a malicious preinstall
On 2026-04-29 Socket Threat Research disclosed a coordinated supply-chain compromise of four SAP-affiliated npm packages: mbt 1.2.48 (Cloud MTA Build Tool, ~52K weekly downloads), @cap-js/db-service 2.10.1 (~260K), @cap-js/postgres 2.2.2 (~10K), and @cap-js/sqlite 2.2.2 (~250K). All four versions were published with an identical malicious package.json preinstall hook that runs node setup.mjs before the legitimate package code is unpacked, ensuring credential collection executes the moment a developer or CI runner runs npm install — even with --ignore-scripts=false defaults.
setup.mjs detects the host architecture (linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64), downloads the matching official Bun JavaScript runtime release from GitHub (github.com/oven-sh/bun/releases), unpacks it to a hidden directory under the user's home, and uses Bun to execute execution.js. The choice of Bun is operationally novel: it bypasses Node-level npm security tooling, provides single-binary execution that defeats some EDR JS-content inspection, and enables fast TypeScript-style execution of the obfuscated payload without a node_modules tree of its own. execution.js itself is heavily obfuscated using a __decodeScrambled cipher previously observed in TeamPCP-linked Trivy, LiteLLM, Checkmarx, and Bitwarden compromises.
Once decoded, the stealer enumerates the filesystem for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and config, ~/.azure/, ~/.config/gcloud/, ~/.docker/config.json, ~/.kube/config, ~/.npmrc, ~/.gitconfig, ~/.gnupg/, environment files (.env, .env.local), Helm/Terraform state, GitHub Actions runner working directories, and CI variables exposed via GITHUB_TOKEN, NPM_TOKEN, AWS_*, AZURE_*, GCP_* environment variables. It additionally queries the cloud Instance Metadata Service endpoints 169.254.169.254 (AWS IMDSv1/v2, Azure IMDS), 169.254.170.2 (AWS ECS task metadata v2), 127.0.0.1:40342 (Azure Instance Metadata legacy), and metadata.google.internal (GCP) to harvest IAM role temporary credentials.
Collected secrets are concatenated, encrypted with RSA-OAEP-4096 using a hard-coded attacker public key, and base64-encoded. The stealer then authenticates to GitHub using the victim's own discovered token and creates a public repository whose name follows the pattern <word>-<word>-<3 digits> with description 'A Mini Shai-Hulud has Appeared'. The encrypted blob is committed as a file with the message 'chore: update dependencies'. Operators retrieve victims by issuing a GitHub code search for the dead-drop query OhNoWhatsGoingOnWithGitHub, an embedded marker string. Before any of this runs, an execution-guardrail check inspects the system locale; if it contains a Russian (ru-*) language tag, execution exits cleanly — a signature of the broader campaign cluster.
The @cap-js/* package compromise vector was account takeover of legitimate SAP cap-js maintainer RoshniNaveenaS: the attacker pushed a modified GitHub Actions workflow on a non-main branch that exfiltrated the cap-js repository's npm OIDC token, then used that token to publish the malicious versions without provenance attestations. The mbt 1.2.48 compromise is suspected to involve the static npm publish token of the cloudmtabot SAP service account; the exact takeover channel is undetermined and under SAP investigation. SAP and the cap-js maintainers unpublished the malicious versions within hours, but anyone whose CI ran npm install or npm ci against an unpinned range during the exposure window — and whose lockfile resolved the malicious version — must assume cloud and source-control credentials are compromised, rotate every secret reachable from the affected runner, audit GitHub for repositories matching the naming and description signature created from their accounts, and remove any such repos.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-915, CWE-494, CWE-522
Target sectors: technology, software-development, enterprise-software, saas, financial, manufacturing, government
Target regions: global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1585.001, T1587.001, T1588.002, T1195.002, T1199, T1059.007, T1204.002, T1546, T1027