SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer

SAP CAP & Cloud MTA npm Packages Compromised (TL-2026-0439), also tracked as Mini Shai-Hulud, is a critical-severity supply-chain compromise, first published 2026-04-30. It is attributed to TeamPCP with medium confidence, affects SAP Cloud MTA Build Tool (mbt), maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0439

Threat ID
TL-2026-0439
Also known as
Mini Shai-Hulud, TeamPCP SAP CAP campaign, cap-js npm compromise (April 2026)
Severity
CRITICAL
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-30
Last reviewed
2026-04-30
Attribution
TeamPCP
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development, enterprise-software, saas, financial, manufacturing, government
Target regions
global
Detection rules
9
Indicators of compromise
22

Malware and tooling in SAP CAP & Cloud MTA npm Packages Compromised

Malware and tooling: Mini Shai-Hulud, Bun JavaScript runtime (oven-sh/bun)

On 2026-04-29, four official SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite) — with ~570K combined weekly downloads — were trojanized with a malicious preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime to execute an obfuscated credential harvester (execution.js). The malware exfiltrates SSH keys, cloud tokens (AWS/Azure/GCP), npm/GitHub tokens, Kubernetes/Docker configs, and CI runner secrets as RSA-OAEP-4096 ciphertext to attacker-controlled GitHub repositories tagged 'A Mini Shai-Hulud has Appeared'. Researchers attribute the campaign with medium confidence to TeamPCP based on a shared __decodeScrambled cipher and Russian-locale kill switches that match prior Trivy, LiteLLM, Checkmarx, and Bitwarden npm compromises.

How SAP CAP & Cloud MTA npm Packages Compromised works

On 2026-04-29 Socket Threat Research disclosed a coordinated supply-chain compromise of four SAP-affiliated npm packages: mbt 1.2.48 (Cloud MTA Build Tool, ~52K weekly downloads), @cap-js/db-service 2.10.1 (~260K), @cap-js/postgres 2.2.2 (~10K), and @cap-js/sqlite 2.2.2 (~250K). All four versions were published with an identical malicious package.json preinstall hook that runs node setup.mjs before the legitimate package code is unpacked, ensuring credential collection executes the moment a developer or CI runner runs npm install — even with --ignore-scripts=false defaults.

setup.mjs detects the host architecture (linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64), downloads the matching official Bun JavaScript runtime release from GitHub (github.com/oven-sh/bun/releases), unpacks it to a hidden directory under the user's home, and uses Bun to execute execution.js. The choice of Bun is operationally novel: it bypasses Node-level npm security tooling, provides single-binary execution that defeats some EDR JS-content inspection, and enables fast TypeScript-style execution of the obfuscated payload without a node_modules tree of its own. execution.js itself is heavily obfuscated using a __decodeScrambled cipher previously observed in TeamPCP-linked Trivy, LiteLLM, Checkmarx, and Bitwarden compromises.

Once decoded, the stealer enumerates the filesystem for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and config, ~/.azure/, ~/.config/gcloud/, ~/.docker/config.json, ~/.kube/config, ~/.npmrc, ~/.gitconfig, ~/.gnupg/, environment files (.env, .env.local), Helm/Terraform state, GitHub Actions runner working directories, and CI variables exposed via GITHUB_TOKEN, NPM_TOKEN, AWS_*, AZURE_*, GCP_* environment variables. It additionally queries the cloud Instance Metadata Service endpoints 169.254.169.254 (AWS IMDSv1/v2, Azure IMDS), 169.254.170.2 (AWS ECS task metadata v2), 127.0.0.1:40342 (Azure Instance Metadata legacy), and metadata.google.internal (GCP) to harvest IAM role temporary credentials.

Collected secrets are concatenated, encrypted with RSA-OAEP-4096 using a hard-coded attacker public key, and base64-encoded. The stealer then authenticates to GitHub using the victim's own discovered token and creates a public repository whose name follows the pattern <word>-<word>-<3 digits> with description 'A Mini Shai-Hulud has Appeared'. The encrypted blob is committed as a file with the message 'chore: update dependencies'. Operators retrieve victims by issuing a GitHub code search for the dead-drop query OhNoWhatsGoingOnWithGitHub, an embedded marker string. Before any of this runs, an execution-guardrail check inspects the system locale; if it contains a Russian (ru-*) language tag, execution exits cleanly — a signature of the broader campaign cluster.

The @cap-js/* package compromise vector was account takeover of legitimate SAP cap-js maintainer RoshniNaveenaS: the attacker pushed a modified GitHub Actions workflow on a non-main branch that exfiltrated the cap-js repository's npm OIDC token, then used that token to publish the malicious versions without provenance attestations. The mbt 1.2.48 compromise is suspected to involve the static npm publish token of the cloudmtabot SAP service account; the exact takeover channel is undetermined and under SAP investigation. SAP and the cap-js maintainers unpublished the malicious versions within hours, but anyone whose CI ran npm install or npm ci against an unpinned range during the exposure window — and whose lockfile resolved the malicious version — must assume cloud and source-control credentials are compromised, rotate every secret reachable from the affected runner, audit GitHub for repositories matching the naming and description signature created from their accounts, and remove any such repos.

MITRE ATT&CK techniques used in TL-2026-0439

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1480 Execution Guardrails

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Command and Control

T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Persistence

T1546 Event Triggered Execution

Exfiltration

T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Resource Development

T1585.001 Establish Accounts: Social Media Accounts; T1586 Compromise Accounts; T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool

Affected products and versions in SAP CAP & Cloud MTA npm Packages Compromised

  • SAP — Cloud MTA Build Tool (mbt)
    Vulnerable versions: 1.2.48
  • SAP cap-js — @cap-js/db-service
    Vulnerable versions: 2.10.1
  • SAP cap-js — @cap-js/postgres
    Vulnerable versions: 2.2.2
  • SAP cap-js — @cap-js/sqlite
    Vulnerable versions: 2.2.2

Remediation for SAP CAP & Cloud MTA npm Packages Compromised

Patches

  • Upgrade mbt to a clean version above 1.2.48 once SAP publishes a remediated release; verify provenance
  • Upgrade @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite to clean versions republished by the cap-js maintainers; verify provenance attestations are present

Immediate actions

  • Audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, @cap-js/sqlite@2.2.2 and pin to last-known-good versions
  • Treat any developer workstation or CI runner that resolved a malicious version as fully compromised; rotate ALL SSH keys, cloud credentials (AWS/Azure/GCP), npm tokens, GitHub PATs, and OIDC trust relationships exposed to that host
  • Search the affected GitHub organizations and personal accounts for repositories matching the pattern <word>-<word>-<3 digits> with description 'A Mini Shai-Hulud has Appeared' and delete them after preserving forensic copy
  • Run a GitHub code search for the marker 'OhNoWhatsGoingOnWithGitHub' across owned repos to identify dead-drop artifacts
  • Block outbound DNS to github.com release downloads of oven-sh/bun from CI runners that have no legitimate need for the Bun runtime
  • Disable npm preinstall/postinstall lifecycle scripts in CI by setting npm_config_ignore_scripts=true or using --ignore-scripts on production builds

Workarounds

  • Pin direct and transitive versions to last-known-good releases via overrides/resolutions until vendors confirm clean republish
  • Use --ignore-scripts on npm install in CI as a defense-in-depth control
  • Consume packages via an internal Verdaccio/Artifactory mirror that quarantines new versions until reviewed

Longer-term hardening

  • Mandate npm provenance attestations (--provenance) for all internally-published packages and verify provenance on consumed dependencies
  • Enforce hardware-backed MFA on every npm publisher account and require trusted publishers / OIDC with branch-pinned workflows
  • Move package publication from long-lived npm tokens (e.g. service accounts like cloudmtabot) to short-lived OIDC issued only from protected main-branch workflows
  • Deploy SCA tooling (Socket, Snyk, Aikido, Wiz, Endor) configured to alert on new transitive packages and lifecycle scripts
  • Restrict IMDS access from CI runners using IMDSv2 with hop-limit=1 and explicit AWS/Azure/GCP IAM scoping; deny pod/container metadata where not required
  • Implement egress filtering on developer workstations and CI to prevent unauthorized GitHub API repo creation by automation tokens

Weaknesses (CWE) in SAP CAP & Cloud MTA npm Packages Compromised

CWE-506, CWE-829, CWE-915, CWE-494, CWE-522

Timeline of SAP CAP & Cloud MTA npm Packages Compromised

  • Researchers tag the operation 'Mini Shai-Hulud' after the embedded GitHub repository description string 'A Mini Shai-Hulud has Appeared'
  • SAP and the cap-js maintainer team unpublish the malicious package versions from npm; investigation into RoshniNaveenaS account takeover and cloudmtabot token compromise begins
  • Coordinated vendor blogs published by Socket, Aikido, Wiz, and Snyk; news coverage by BleepingComputer and The Hacker News
  • Socket attributes campaign with medium confidence to TeamPCP based on shared __decodeScrambled cipher and Russian-locale kill switches matching prior Trivy / LiteLLM / Checkmarx / Bitwarden compromises
  • Socket Threat Research detects the malicious versions via behavioral SCA scanning and identifies the Bun-runtime credential stealer architecture
  • Trojanized versions of mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, and @cap-js/sqlite 2.2.2 published to npm with malicious preinstall hook in package.json
  • Threadlinqs Intelligence publishes TL-2026-0439 with full IOC, MITRE, and detection coverage
  • As of 2026-05-29, the four malicious SAP CAP/MBT npm versions were unpublished within hours of the 2026-04-29 disclosure, neutralizing that specific drop. But attacker TeamPCP and its Mini Shai-Hulud tooling remain highly active — TanStack (May 11), public source leak (May 12), and the atool wave (May 19, 639 versions) confirm an escalating, ongoing campaign.

Sources cited for SAP CAP & Cloud MTA npm Packages Compromised

Threats related to SAP CAP & Cloud MTA npm Packages Compromised

Detection coverage for TL-2026-0439

As of 2026-04-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0439 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats