A sophisticated supply chain attack has infiltrated multiple official SAP npm packages, deploying advanced credential-stealing malware that specifically targets enterprise development environments and CI/CD pipelines. The compromise affects critical packages supporting SAP's Cloud Application Programming Model, putting thousands of enterprise developers at risk.
The Scope of the Breach
Four essential SAP packages fell victim to this coordinated attack: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt. These packages form the backbone of many enterprise SAP implementations, making the compromise particularly concerning for organizations relying on SAP's development ecosystem.
The attack demonstrates a concerning evolution in supply chain threats, moving beyond simple malware deployment to sophisticated credential harvesting operations specifically designed for enterprise environments. The malicious code executes automatically through a 'preinstall' script, ensuring immediate compromise upon package installation.
Advanced Payload Mechanics
The attack employs a multi-stage execution process that showcases remarkable technical sophistication. Upon installation, the malicious script downloads the Bun JavaScript runtime from GitHub and uses it to execute heavily obfuscated payload code designed to evade detection.
The information-stealing capabilities are comprehensive and enterprise-focused, targeting:
Most concerning is the malware's ability to extract secrets directly from CI runner memory, bypassing traditional security controls and log masking mechanisms that enterprises rely on to protect sensitive information during automated deployments.
Memory Extraction and Data Exfiltration
The payload includes an embedded Python script specifically designed to read process memory from CI runners, searching for secrets matching specific patterns. This technique allows the malware to capture credentials that would normally be protected by CI platform security measures.
Once collected, stolen data is encrypted and uploaded to public GitHub repositories created under the victim's account. These repositories are marked with distinctive descriptions that serve as indicators of compromise, allowing security teams to identify affected systems.
The malware's use of GitHub commit searches as a dead-drop mechanism for token retrieval demonstrates an advanced understanding of developer workflows and version control systems.
The attack also includes self-propagation capabilities, using stolen credentials to modify additional packages and repositories, creating a cascading effect that can rapidly spread across development environments.
Attribution and Attack Patterns
Security researchers have identified similarities to previous supply chain attacks attributed to the TeamPCP threat group, including identical memory scanning techniques and characteristic indicators. The group has previously targeted security tools and development platforms, suggesting a focused campaign against the software supply chain.
The compromise method remains under investigation, though evidence suggests potential exposure of npm publishing tokens through misconfigured CI/CD infrastructure, highlighting the interconnected nature of modern development security risks.
Impact on Enterprise Security
This incident represents a significant escalation in supply chain threats targeting enterprise development environments. Unlike consumer-focused attacks, this campaign specifically targets the authentication mechanisms and secrets that power enterprise software development and deployment.
The focus on CI/CD environments is particularly troubling, as these systems often have elevated privileges and access to production infrastructure. A successful compromise could provide attackers with unprecedented access to enterprise networks and sensitive data.
What You Should Do
Organizations using SAP development tools should immediately audit their npm dependencies and CI/CD environments for signs of compromise. Key actions include:
- Check for the presence of affected package versions in your development environments
- Monitor GitHub repositories associated with your organization for suspicious repositories with "Shai-Hulud" references
- Rotate npm tokens, GitHub credentials, and cloud platform access keys used in development workflows
- Implement additional monitoring for memory access patterns in CI/CD runners
- Review and strengthen token management practices across development infrastructure
The incident underscores the critical importance of supply chain security in enterprise environments and the need for comprehensive monitoring across the entire software development lifecycle. As threat actors continue to evolve their tactics to target enterprise development workflows, organizations must adapt their security strategies accordingly.
