SAP npm Packages Compromised by "Mini Shai-Hulud" Credential Stealing Malware

A new supply chain attack campaign, dubbed “mini Shai-Hulud,” is actively targeting SAP-related npm packages with credential-stealing malware. The Hacker News reports that this campaign impacts packages associated with SAP’s JavaScript and cloud application ecosystem. This isn’t just a theoretical threat; it’s a direct assault on the build and deployment pipelines of organizations reliant on SAP development.

Researchers from Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz have all confirmed the compromise. The attackers are clearly leveraging the trust inherent in developer dependencies, a common but highly effective vector. By injecting malicious code into widely used npm packages, they gain access to sensitive credentials, which can then be used to pivot deeper into development environments, cloud infrastructure, or even production systems.

This campaign underscores the critical need for robust supply chain security. Defenders must assume that any third-party dependency, no matter how reputable, can become a conduit for compromise. The attacker’s calculus here is simple: target the weakest link in the software delivery chain to achieve maximum impact with minimal effort. This isn’t about sophisticated zero-days; it’s about exploiting trust and poor hygiene.