A supply chain compromise was discovered in the npm package 'mbt' (SAP Multi-Target Application Build Tool), where a threat actor impersonated SAP maintainers to publish malicious versions. The compromised packages include hidden malicious files that evade manifest allowlist checks but execute during installation. The malicious payload is unusually large and likely designed for credential or token exfiltration in SAP CI/CD pipelines.