On April 29, 2026, a highly coordinated supply chain attack struck the SAP JavaScript and cloud development ecosystem. Threat actors compromised four official npm packages associated with the SAP Cloud Application Programming (CAP) and MTA Build Tool frameworks.
The malicious packages identified as mbt, @cap-js/sqlite, @cap-js/postgres, and @cap-js/db-service were poisoned to deliver a massive credential-stealing malware.
By targeting developer laptops and continuous integration (CI) pipelines, the campaign places enterprise SAP deployments at severe risk.
Attack Vector and Execution
The attackers infiltrated the SAP packages using two independent methods. In the MBT package, the attackers stole a long-lived static npm automation token, which enabled them to publish a malicious version directly without GitHub access.
For the @cap-js packages, the attackers combined a compromised developer GitHub account with a misconfigured OpenID Connect (OIDC) setup.
By pushing code to an alternative branch, they bypassed repository-level trust limits. They generated a temporary token to publish the malware.
This incident highlights a major flaw in developers’ trust in npm provenance attestations. At the same time, the @cap-js packages appeared to have a verified build chain from GitHub Actions; the broad repository trust allowed attackers to generate valid tokens from unauthorized branches.
When a developer runs standard installation commands on these poisoned packages, a hidden pre-install script fires before the process finishes.
This script bypasses standard Node.js monitoring tools by downloading a different JavaScript runtime, Bun. Using Bun enables the malware to rapidly and quietly execute an 11.7 MB obfuscated payload.
The payload uses a large string table and a custom encryption cipher called ctf-scramble-v2. To avoid duplicate infections, the malware uses a temporary lock file to ensure it only runs once per machine.
Target Data and Remediation
The malicious payload operates five parallel data collectors designed to siphon secrets from the victim’s environment.
It aggressively hunts for npm publish tokens, GitHub access tokens, and infrastructure credentials for Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
It also steals Kubernetes service account tokens, SSH private keys, and configuration files for artificial intelligence coding assistants like Claude and Cursor.
Instead of sending stolen data to a traditional external server, the attackers use GitHub as a dead drop.
The malware encrypts the stolen data and automatically creates a new public repository under the victim’s own GitHub account. These newly created repositories are easily identifiable by the description “A Mini Shai-Hulud has Appeared”.
The malware also actively functions as a self-replicating worm. Once it confirms a stolen npm token has publish rights, it automatically patches the victim’s own projects with the same malicious script.
This turns every infected developer into a new distribution node, expanding the attack’s reach across the open-source community.
To ensure it remains active, the payload injects hidden persistence hooks into local development environments, modifying Visual Studio Code configuration files. Hence, the malware runs whenever a project is opened.
According to Endorlabs research, developers who downloaded the affected package versions must assume that all local and cloud credentials have been fully compromised. Victims need to remove the malicious packages using the -immediately-ignore-scripts command.
After removal, all exposed secrets, including cloud access keys, GitHub tokens, and SSH keys, must be rotated immediately.
Organizations should heavily monitor CI/CD pipelines for unexpected workflow changes and migrate away from static npm tokens to strictly scoped OIDC publishing methods.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
