Back Blog.Gitguardian

A Mini Shai-Hulud Targeting the SAP Ecosystem

Blog.Gitguardian • April 29, 2026

Earlier today, Aikido researchers detected multiple compromised Node.js packages in SAP's namespace today. The malware adapts to CI environments, steals GitHub personal access tokens, and uses them to self-propagate—a pattern consistent with recent supply-chain attacks.

The RSA keys used to encrypt the exfiltrated secrets are the same as the ones used last week in the @bitwarden/cli attack .

GitGuardian identified 7 commits containing exposed ghp_ tokens—all remain valid and active at 16h46 EST. The attacker used the stolen tokens to create public repositories, each named with Dune-themed keywords. Inside each repository:

Our telemetry shows the attack's full scope:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 753 sources 71

Extracted Entities

A Mini Shai-Hulud Targeting the SAP Ecosystem

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)