# SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack


A sophisticated supply chain attack has targeted SAP-related packages on npm, the JavaScript package repository, injecting credential-stealing malware into libraries used by thousands of developers. The campaign, dubbed mini Shai-Hulud, represents a growing threat to enterprise software supply chains, with multiple security vendors—Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz—independently identifying and tracking the malicious activity.


## The Threat: Attack Overview


Researchers have discovered that the mini Shai-Hulud campaign compromised multiple npm packages related to SAP's JavaScript and cloud application ecosystem. The infected packages contained malware designed to steal credentials and sensitive information from developers' environments, posing a significant risk to any organization using these libraries in their applications.


The attack demonstrates a troubling evolution in supply chain compromise tactics:


  • Targeted scope: Attackers specifically focused on packages associated with enterprise software environments (SAP)
  • Credential theft objective: Rather than broad system compromise, the malware was designed to exfiltrate authentication tokens, API keys, and user credentials
  • Multi-detection: The fact that multiple independent security vendors identified the attack suggests the malware was active for a measurable period before detection
  • Coordinated research: The collaborative disclosure from five different security organizations indicates the scope and severity of the compromise

    • ## Background and Context: Why SAP Packages Matter


    SAP is among the world's largest enterprise resource planning (ERP) software providers, used by organizations across finance, manufacturing, healthcare, retail, and government sectors. JavaScript packages associated with SAP's ecosystem are critical components in modern cloud and web application development.


    Why attackers targeted SAP packages:


  • High-value targets: SAP customers are typically large enterprises with valuable credentials and sensitive business data
  • Supply chain leverage: Compromising npm packages reaches multiple organizations through a single infection vector
  • Developer trust: Developers often assume packages from enterprise vendors are legitimate, reducing scrutiny
  • Integration depth: SAP-related packages are deeply integrated into production environments, maximizing potential impact

    • The attack reflects a broader trend where threat actors have shifted from targeting end-user applications to compromising the software supply chain at intermediate points—specifically open-source package repositories.


    ## Technical Details: How the Attack Worked


    ### Package Infection Mechanism


    The compromised packages were modified to include malicious code that executed during installation or runtime. The specific mechanisms likely included:


    | Attack Component | Function |

    |---|---|

    | Installation hooks | Code executed during npm install process, before developer awareness |

    | Environment enumeration | Scanning for environment variables containing API keys and credentials |

    | Credential exfiltration | Sending stolen tokens to attacker-controlled infrastructure |

    | Obfuscation | Code obscured or split across multiple files to evade detection |


    ### The "mini Shai-Hulud" Campaign


    Named after the fictional sandworms in *Dune*, the campaign appears designed with specific operational objectives:


  • Selective targeting: The attackers focused on SAP-related packages rather than deploying broadly across npm
  • Credential-specific payload: The malware was optimized for stealing authentication materials (API keys, OAuth tokens, session credentials)
  • Sophisticated obfuscation: Code was deliberately obscured to complicate analysis by automated and manual security tools
  • Stealthy exfiltration: Data theft occurred quietly without triggering obvious system anomalies

    • ## Implications for Organizations


    ### Immediate Impact


    Organizations using affected packages face several risks:


    1. Credential compromise: Any credentials stored in environment variables or configuration files accessible to the npm environment were potentially exposed

    2. Lateral movement: Stolen API keys could enable attackers to access downstream systems and services

    3. Supply chain contamination: Organizations may have unknowingly built applications containing malicious code

    4. Regulatory exposure: Data breaches resulting from the compromise could trigger compliance obligations (GDPR, HIPAA, SOC 2, etc.)


    ### Downstream Effects


  • Supply chain cascade: Organizations using compromised applications could themselves become attack vectors
  • Trust erosion: The attack undermines confidence in open-source npm packages as a category
  • Incident response burden: Affected organizations must audit dependency trees, rebuild applications, and rotate credentials
  • Reputation risk: Enterprises may face customer and partner scrutiny if their applications were contaminated

    • ## Mitigation and Recommendations


    ### Immediate Actions


    Organizations should take these steps now:


    1. Audit npm dependencies: Review package.json and lock files for any affected packages

    2. Check for installation dates: Identify when compromised versions were installed

    3. Rotate credentials: Change any API keys, tokens, or credentials that were active during the infection window

    4. Scan application code: Review source control history for suspicious code or unauthorized changes

    5. Rebuild and redeploy: Rebuild applications using known-clean package versions and redeploy to production


    ### Detection and Investigation


  • Log analysis: Review environment logs from the installation period for unusual exfiltration
  • Network monitoring: Check for outbound connections to attacker infrastructure from build and deployment systems
  • Security alerts: Query SIEM systems for indicators of compromise related to credential access

    • ### Longer-Term Prevention


    Strengthen supply chain security:


    | Strategy | Implementation |

    |----------|---|

    | Package verification | Implement Software Bill of Materials (SBOM) generation and verification |

    | Dependency scanning | Deploy continuous scanning tools (Snyk, npm audit, Socket, Wiz) in CI/CD pipelines |

    | Access controls | Limit environment variable access and secrets exposure in build environments |

    | Code review | Strengthen code review processes for dependency updates and package changes |

    | Signed packages | Prioritize packages with cryptographic signatures and verified publisher identities |


    ### Enterprise Governance


  • Maintain approved package lists: Curate internal registries of vetted, approved npm packages
  • Incident response planning: Develop and test procedures for supply chain compromise scenarios
  • Vendor communication: Coordinate with SAP and package maintainers on remediation timelines
  • Incident reporting: File reports with relevant regulatory bodies and customers if compliance obligations apply

    • ## Broader Lessons


    The mini Shai-Hulud campaign illustrates critical vulnerabilities in open-source supply chains:


    1. npm as a critical infrastructure: The JavaScript ecosystem is foundational to modern software, requiring equivalent security rigor as compiled language repositories

    2. Detection gaps: Multiple independent vendors identified the attack, suggesting it persisted longer than desired before widespread detection

    3. Attacker sophistication: The targeted, credential-focused approach demonstrates advanced operational planning by threat actors

    4. Shared responsibility: Security depends on collaboration between platform maintainers, package publishers, enterprises, and security researchers


    ## Conclusion


    The compromise of SAP-related npm packages represents a significant escalation in supply chain attack sophistication. By targeting specific enterprise ecosystems with credential-stealing malware, the mini Shai-Hulud campaign demonstrates that threat actors are evolving their tactics beyond broad indiscriminate attacks toward precision supply chain compromise.


    Organizations must treat this as a wake-up call to audit their dependency chains, strengthen credential management, and implement continuous monitoring of their software supply chains. The collaborative response from Aikido Security, SafeDep, Socket, StepSecurity, and Wiz—along with rapid disclosure—demonstrates that community vigilance remains essential until the broader npm ecosystem implements stronger verification mechanisms.


    For organizations using SAP-related JavaScript packages, immediate action is warranted: audit affected installations, rotate credentials, and rebuild applications with verified clean dependencies. This incident underscores that in the modern software landscape, supply chain security is not optional—it is essential operational security.