SAP npm Package Supply Chain Attack Leveraging "Mini Shai-Hulud" Credential Malware via AI Tool Configuration Abuse
Summary
Hide ▲
Show ▼
A coordinated supply chain attack compromised multiple SAP-related npm packages with credential-stealing malware dubbed "Mini Shai-Hulud". The attack introduced malicious preinstall scripts in affected package versions, which downloaded and executed a 11.6 MB payload from GitHub Releases at installation time, targeting developer and CI/CD environments. Stolen credentials from GitHub, npm, AWS, Azure, GCP, Kubernetes, and other services were encrypted and exfiltrated to attacker-controlled repositories labeled "A Mini Shai-Hulud has Appeared". The attack also abused AI coding agent configurations in VS Code and Claude Code for persistence and propagation.
Timeline
-
29.04.2026 19:26 1 articles · 2h ago
SAP npm Package Supply Chain Compromise via Mini Shai-Hulud Malware Disclosed
Compromised npm packages [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published on April 29, 2026, between 09:55–12:14 UTC, each including malicious preinstall hooks that downloaded and executed a 11.6 MB credential-stealing payload from GitHub Releases. The malware harvested and encrypted developer and cloud secrets, exfiltrating them to attacker-controlled GitHub repositories, while self-propagating via GitHub Actions workflow injection and abusing AI tool configurations for persistence on VS Code and Claude Code.
Show sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
Information Snippets
-
Four npm packages associated with SAP’s JavaScript and cloud application development ecosystem were compromised: [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected].
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
-
Compromised versions were published on April 29, 2026, between 09:55 UTC and 12:14 UTC, each introducing a malicious preinstall hook running setup.mjs to load a Bun runtime and execute the credential stealer and propagation framework (execution.js).
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
-
The malware harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets from AWS, Azure, GCP, and Kubernetes, encrypting the data with AES-256-GCM and RSA-4096 and exfiltrating it to attacker-controlled GitHub repositories.
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
-
The payload includes self-propagation mechanisms, injecting malicious GitHub Actions workflows into victim repositories to steal secrets and publish poisoned npm package versions, while also abusing AI tool configurations for persistence and execution.
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
-
Over 1,100 attacker-created GitHub repositories with the description "A Mini Shai-Hulud has Appeared" have been identified as exfiltration endpoints for stolen data.
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26
-
The attack targets systems with Russian locale and abuses VS Code (.vscode/tasks.json with "runOn":"folderOpen") and Claude Code (.claude/settings.json with SessionStart hook) configurations to trigger malware execution upon project open.
First reported: 29.04.2026 19:261 source, 1 articleShow sources
- SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware — thehackernews.com — 29.04.2026 19:26