2026 SAP — CAP npm packages compromised (TeamPCP-style; infostealer preinstall; Apr)
Data compromised
Developer and CI/CD secrets exfiltrated from machines that installed poisoned packages—no centralized consumer row count
Technical writeup
On April 29, 2026, BleepingComputer, Aikido, and Socket reported that several official SAP npm packages supporting the Cloud Application Programming Model (CAP) and Cloud MTA Build Tool—@cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48—were trojanized with malicious preinstall scripts launching Bun-based loaders and obfuscated JavaScript stealers. The malware harvested npm and GitHub tokens, SSH keys, and cloud/CI secrets (including memory scraping on GitHub Actions workers framed as structurally similar to prior Bitwarden and Checkmarx incidents), exfiltrating via attacker-created GitHub repos tagged with “Mini Shai-Hulud” messaging. Researchers linked tactics with medium confidence to TeamPCP’s broader npm supply-chain wave (Trivy, Bitwarden, Checkmarx); suspected initial access included a leaked npm publish token via a misconfigured CircleCI job in analyst social threads. Affected versions were deprecated on npm; downstream risk is developer and enterprise pipeline credential compromise—not a single end-user account table.
Root cause
Compromise of npm publishing pipeline / stolen maintainer token; malicious package versions distributed via registry