Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Mini Shai-Hulud SAP-related npm supply-chain campaign

Campaign
First reported
Last updated
Happening score
H score 45
1 unique sources, 2 articles

Summary

Hide ▲

A new Mini Shai-Hulud supply-chain campaign is targeting SAP-related npm packages, putting developer and CI/CD environments at risk of credential theft and malicious package propagation. The poisoned releases published on April 29, 2026 used a preinstall flow to bootstrap Bun, execute malware, and exfiltrate secrets. The operation matters because it can spread through trusted package and workflow paths while stealing GitHub/npm tokens and cloud secrets.

Related Happenings

GitHub API enumeration campaign targeting corporate organizations

Campaign
H score17 First: 09.07.2026 21:38 Last: 09.07.2026 21:38 Sources 1

About this happening: A **GitHub API reconnaissance campaign** is systematically mapping **corporate organizations**, repositories, and user accounts across multiple companies, expanding the risk of fo...

Open Happening

GitHub npm version 12 hardens installs and token management

Security Tool/Service
H score11 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: **GitHub** released **npm version 12**, making install-time scripts opt-in by default and tightening **package publishing** controls to reduce **supply-chain risk**. The update al...

Open Happening

GitHub npm GAT publish-token mitigation guidance

Advisory/Mitigation
H score25 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub is steering **npm users** away from **long-lived publish tokens** as **npm GATs** that bypass **2FA** lose direct publishing and sensitive-management abilities. The recomme...

Open Happening

Malicious npm and PyPI payment SDK typosquat packages

Malware Activity
H score40 First: 09.07.2026 18:09 Last: 09.07.2026 18:09 Sources 1

About this happening: The **17 malicious npm and PyPI packages** targeted **Paysafe, Skrill, and Neteller SDKs** to steal **system information** and **developer secrets**, then send the data to an **Ng...

Open Happening

Malicious npm and PyPI Paysafe, Skrill, and Neteller SDK packages delivering stealer malware

Malware Activity
H score37 First: 08.07.2026 22:54 Last: 08.07.2026 22:54 Sources 1

About this happening: Malicious **npm** and **PyPI** packages impersonating **Paysafe**, **Skrill**, and **Neteller** SDKs delivered **stealer malware** that siphoned secrets from developer environment...

Open Happening

Timeline

  1. 12.05.2026 11:50 1 articles · 1mo ago

    Mini Shai-Hulud spreads to TanStack and PyPI packages

    Campaign Scope Update

    Mini Shai-Hulud expands beyond the original SAP-related npm packages to compromise TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and DraftLab packages across npm and PyPI, with malicious payloads using router_init.js, GitHub Actions abuse, and exfiltration to filev2.getsession[.]org, api.masscan[.]cloud, or attacker-controlled GitHub repositories.

    Show sources
    Open in new tab
  2. 29.04.2026 19:26 1 articles · 2mo ago

    Mini Shai-Hulud publishes malicious SAP-related npm packages

    Exploitation Observed

    The Mini Shai-Hulud campaign published poisoned releases for [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected], adding a package.json preinstall hook that loads setup.mjs, downloads a platform-specific Bun ZIP from GitHub Releases, and runs execution.js to steal credentials and propagate through developer and release workflows.

    Show sources
    Open in new tab
  3. 29.04.2026 19:26 1 articles · 2mo ago

    Researchers analyze Mini Shai-Hulud credential theft and persistence

    Technical Analysis Update

    Researchers from Aikido Security, Onapsis, OX Security, SafeDep, Socket, StepSecurity, and Wiz described Mini Shai-Hulud as a supply-chain campaign affecting SAP's JavaScript and cloud application development ecosystem, noted that the malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets from AWS, Azure, GCP, and Kubernetes, and said the payload exfiltrates data to victim-owned GitHub repositories while injecting .claude/settings.json and .vscode/tasks.json for persistence. Wiz also said the packages share features with prior TeamPCP operations and use a TeamPCP-linked shared RSA public key.

    Show sources
    Open in new tab