Multiple npm packages related to SAP CAP and Cloud MTA development were compromised in a supply chain attack attributed to the adversary TeamPCP. The affected package versions introduced malicious preinstall scripts that download and execute Bun binaries hosted on GitHub. These binaries run heavily obfuscated payloads designed to harvest sensitive credentials such as SSH keys, cloud service credentials, npm tokens, GitHub access tokens, cryptocurrency wallets, and CI/CD secrets directly from memory in developer and CI/CD environments. The stolen data is encrypted and exfiltrated through GitHub repositories created under the victim's accounts. The malware also attempts to propagate by injecting malicious code into additional npm packages using stolen npm tokens and maintains persistence by modifying VSCode and Claude IDE configurations. The attack leverages supply chain compromise to infiltrate development environments and steal sensitive credentials, but no known exploits in the wild or official patches are currently documented.

The attack results in credential theft from developer machines and CI/CD environments, including SSH keys, cloud credentials, npm tokens, GitHub access tokens, cryptocurrency wallets, and CI/CD secrets. This can lead to unauthorized access to source code repositories, cloud infrastructure, package publishing accounts, and potentially financial assets. The malware's ability to self-propagate and establish persistence increases the risk of prolonged compromise and further spread within affected development ecosystems. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or updates are released, developers should avoid using the affected package versions (mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, @cap-js/sqlite@2.2.2). Review and revoke any potentially compromised credentials such as npm tokens, GitHub tokens, SSH keys, and cloud credentials. Inspect and clean developer and CI/CD environments for unauthorized Bun binaries and suspicious preinstall scripts. Monitor for unauthorized GitHub repository creations under your accounts. Remove any persistence mechanisms in VSCode and Claude IDE configurations. Follow updates from SAP and npm regarding patches or further mitigation steps.