April 29, 2026 | TeamPCP Attribution | Active Exfiltration Confirmed
What Hit
Four packages from SAP’s Cloud Application Programming Model (CAP) toolchain were poisoned: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt — the Cloud MTA Build Tool. All four carry roughly 570,000 combined weekly downloads and sit inside enterprise SAP CI/CD pipelines touching production cloud infrastructure.
Attack Mechanics — How It Worked
Malicious versions were published on April 29 between 09:55 UTC and 12:14 UTC. The poisoned packages introduce a preinstall hook in package.json that executes setup.mjs — a loader for the Bun JavaScript runtime — which then runs the credential stealer and propagation framework (execution.js).
The Bun runtime angle is deliberate evasion. Instead of relying on Node.js to run the payload, the dropper downloads. Bun at install time and uses it to execute a heavily obfuscated 11 MB second-stage payload — bypassing standard Node.js module resolution and eliminating dependency-graph evidence.
What Gets Stolen
The multi-stage payload harvests developer and CI/CD secrets: GitHub tokens, npm credentials, cloud secrets from AWS, Azure, and GCP, Kubernetes tokens, GitHub Actions secrets — and now, a new capability added to this variant — browser-stored passwords from Chrome, Safari, Edge, Brave, and Chromium. This browser credential theft was not present in any previous Shai-Hulud operations.
Exfiltration & Persistence
Stolen data is encrypted with AES-256-GCM and exfiltrated to public GitHub repositories created on the victim’s own account, all tagged with the description “A Mini Shai-Hulud has Appeared.” Over 1,100 such repositories are already visible on GitHub.
The persistence mechanism is particularly nasty. For victims running inside GitHub Actions, the malware uses the stolen token to commit malicious files — including a .vscode/tasks.json — directly to the victim’s own repositories. Any developer who later clones and opens that repository in VS Code re-triggers the dropper. Persistence through the developer’s own trusted toolchain.
Self-Propagation
Using any stolen npm tokens, the malware identifies other packages under the compromised maintainer’s account, injects malicious code, and republishes them — enabling exponential, automated spread across the npm ecosystem without actor intervention.
Root Cause — How SAP’s Publishing Pipeline Got Compromised
Two separate intrusion paths:
- For the
@cap-jspackages — a compromised developer account (RoshniNaveenaS) and an OIDC trusted publishing configuration that trusted thecap-js/cds-dbsrepository broadly instead of a specific workflow on a protected branch. - For
mbt— an npm token likely exposed via a misconfigured CircleCI job.
The SLSA provenance gap is the smoking gun. The legitimate @cap-js/sqlite v2.2.1 carries npm publish attestations and an SLSA provenance statement. The malicious v2.2.2 has zero attestations — the packages were published directly to npm, bypassing the CI/CD pipeline entirely.
Attribution
Wiz attributes this to TeamPCP with high confidence, based on a shared RSA public key used to encrypt exfiltrated secrets — meaning only TeamPCP holds the private key to decrypt the stolen payloads. The same encoding routines, region guardrails, and npm install hook pattern were used in prior TeamPCP operations targeting Trivy, Checkmarx, and Bitwarden CLI.
The Russian geofencing is back too — if the system language resolves to ru, the malware self-terminates immediately.
Immediate Response If You’re Exposed
If npm install touched any of the four affected versions on or after April 29:
- Rotate everything — GitHub tokens (all scopes), npm tokens, AWS/Azure/GCP access keys, Kubernetes tokens, CI/CD secrets
- Search GitHub for repositories with description
"A Mini Shai-Hulud has Appeared"on your account - Search commit history for
OhNoWhatsGoingOnWithGitHub(propagation marker) - Audit
.vscode/tasks.jsonadditions in any repositories - Monitor for unexpected Bun runtime downloads during
npm install
Very nice.