The Mini Shai-Hulud supply chain attack injected malicious preinstall hooks into four SAP NPM packages (mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, and @cap-js/sqlite 2.2.2) used in SAP's Cloud Application Programming ecosystem. These hooks downloaded and executed a Bun binary from a GitHub repository, enabling the malware to steal local credentials and cloud secrets including AWS, Azure, GCP, GitHub Action, Kubernetes tokens, and more. The stolen data was exfiltrated through public GitHub repositories with a specific marker. The malware also propagated by modifying package tarballs and publishing them using stolen GitHub Actions tokens. The attack likely originated from a compromised NPM token exposed via CircleCI pull request builds. The malicious versions were live for a short window (2-4 hours) before being unpublished and replaced with clean versions. The incident is attributed to the TeamPCP group based on cryptographic evidence.

The attack compromises developer environments and build pipelines by injecting malicious code into widely used SAP NPM packages, potentially exposing sensitive credentials and cloud secrets. This can lead to unauthorized access to cloud resources, source code repositories, and deployment workflows. The short exposure window limited the spread, but organizations using affected SAP CAP packages during that time risked credential theft and supply chain compromise. The malware's propagation mechanism could further spread the infection within development ecosystems.

The malicious package versions were unpublished within hours and replaced with clean versions. Organizations should verify if they installed the affected package versions (mbt 1.2.48, @cap-js/db-service 2.10.1, @cap-js/postgres 2.2.2, @cap-js/sqlite 2.2.2) during the exposure window and update to the clean versions immediately. Review and rotate any potentially exposed credentials, tokens, and secrets related to affected environments. Audit build and deployment pipelines for unauthorized modifications or token exposures, especially those involving CircleCI and GitHub Actions. Follow vendor advisories and security bulletins from SAP and related security researchers for further updates.