Bun-Based Stealer Hits SAP CAP npm Packages

On April 29, 2026, a supply chain attack compromised four npm packages in the SAP development ecosystem by publishing malicious versions of mbt, @cap-js/db-service, @cap-js/sqlite, and @cap-js/postgres, which contained an obfuscated credential-stealing payload. The attack exploited the npm publish workflow's lack of manual approval, using a preinstall hook to execute a Bun-based JavaScript runtime that harvested credentials and created dead-drop repositories on GitHub, tagged with "A Mini Shai-Hulud has Appeared." Despite the worm-like potential for self-propagation, evidence suggests the attack was limited to the initially affected packages. SAP responded by publishing clean versions of the compromised packages, while Snyk issued advisories and flagged the affected releases. The incident highlights the importance of gating npm publish permissions and auditing for indicators of compromise, such as unexpected GitHub repositories and injected workflow files, to prevent similar attacks in the future.