Aikido researchers

The pattern is familiar but also a bit different: a trusted package receives a new preinstall hook, the hook runs a new setup.mjs file, and that loader downloads the Bun JavaScript runtime to execute a large obfuscated payload named execution.js .

The payload is an 11.7 MB credential stealer and propagation framework. It harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, and cloud secrets from AWS, Azure, GCP, and Kubernetes. It then exfiltrates encrypted results through public GitHub repositories.

The malware names those repositories with a hardcoded description:

A Mini Shai-Hulud has Appeared

The compromised packages use npm lifecycle execution. In what we’ve seen so far, package.json was modified to add:

That means the malicious code runs automatically during npm install , before the install has even completed.

The malicious package adds two files:

The normal package code still looks like the legitimate SAP package. In the @cap-js/[email protected] sample, the ordinary files match clean @cap-js/[email protected] byte-for-byte. The compromise is the install hook plus the added payload files.

The first stage, setup.mjs , is a Bun bootstrapper. It checks the operating system and architecture, downloads Bun 1.3.13 from GitHub when needed, extracts the binary, and uses Bun to run execution.js .

‍ The second stage, execution.js , is a single large obfuscated payload. It uses a custom string scrambling layer labeled ctf-scramble-v2 , checks whether it is running in CI, exits on Russian locale settings, and daemonizes itself on non-CI machines.

The payload is built to hit both developer laptops and CI/CD runners.

It attempts to collect:

The GitHub Actions path is especially concerning. The payload includes an embedded Python helper that searches /proc for the Runner.Worker process, reads its memory, and extracts masked secret structures from the runner.

The malware uses GitHub as its exfiltration channel.

The new propagation keyword is:

The malware searches GitHub commits for this string and uses matching commit messages as a token dead-drop. Commit messages matching OhNoWhatsGoingOnWithGitHub: are decoded into GitHub tokens and checked for repository access.

When the malware can create a repository, it uses randomized Dune-themed names, sets the repository description to:

and writes encrypted result files under:

The data is compressed and encrypted before commit using AES-256-GCM, with the AES key wrapped by an embedded RSA public key.

The payload contains logic for spreading through developer and release workflows.

In the analyzed samples, the malware checks for GitHub Actions release automation related to cap-js/cds-dbs . If it sees a release workflow in that repository context, it can modify a package tarball by:

It also attempts to use stolen GitHub Actions tokens to push files into repositories:

The targeted packages sit in normal SAP development workflows. @cap-js/sqlite , @cap-js/postgres , and @cap-js/db-service are part of the SAP CAP database ecosystem, while mbt is used around SAP Cloud MTA build workflows.

That makes this campaign small in package count but potentially high impact. These packages are likely to run on developer machines and CI runners that have access to GitHub, npm, cloud credentials, and enterprise deployment secrets.

lockfiles, package caches, CI logs, internal registries, artifact stores, and developer machines for:

If any affected package was installed, rotate secrets. Do not limit rotation to npm tokens. The payload targets GitHub, npm, cloud providers, Kubernetes, CI secrets, and local developer tooling.

If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.

If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.

For broader coverage across your whole team, Aikido's Endpoint Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.

For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.

Hashes from the analyzed @cap-js/[email protected] sample:

Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.