SAP npm Packages Compromised in TeamPCP Supply-Chain Attack

Recently, multiple official SAP npm packages fell victim to a supply-chain attack orchestrated by TeamPCP. The attack aimed to steal credentials and authentication tokens from developers’ systems.

Security researchers have identified four compromised packages that are now deprecated on NPM:

• @cap-js/sqlite – v2.2.2
• @cap-js/postgres – v2.2.2
• @cap-js/db-service – v2.10.1
• mbt – v1.2.48

These packages play a crucial role in supporting SAP’s Cloud Application Programming Model (CAP) and Cloud MTA, widely used in enterprise development.

Reports from Aikido and Socket reveal that the compromised packages were altered to include a malicious ‘preinstall’ script. This script triggers the execution of setup.mjs, a loader that downloads the Bun JavaScript runtime from GitHub to run a heavily obfuscated execution.js payload.

The payload, an information-stealer, targets a wide range of credentials from developer machines and CI/CD environments, including npm and GitHub authentication tokens, SSH keys, cloud credentials, Kubernetes configuration, and CI/CD pipeline secrets.

Furthermore, the malware attempts to extract secrets directly from CI runner memory, bypassing log masking applied by the CI platform.

Once collected, the stolen data is encrypted and uploaded to public GitHub repositories under the victim’s account, marked with the description, “A Mini Shai-Hulud has Appeared.”

The malware also leverages GitHub commit searches as a dead-drop mechanism to retrieve tokens and escalate access.

Similar to past attacks, the malware contains code to self-propagate to other packages using stolen npm or GitHub credentials, injecting the same malicious code to spread further.

Security researchers have linked this attack to the TeamPCP threat actors, noting similarities in code and tactics used in previous attacks against Trivy, Checkmarx, and Bitwarden.

While the method of compromise in SAP’s npm publishing process remains unclear, Security Engineer Adnan Khan suggests a potential exposure of an NPM token through a misconfigured CircleCI job.

Efforts to reach SAP for further clarification on the compromised npm packages have not yielded a response as of now.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), witness how autonomous, context-rich validation identifies exploitable vulnerabilities, confirms control effectiveness, and completes the remediation cycle.

Claim Your Spot