SAP npm Packages Compromised to Harvest Developer and CI/CD Secrets

A supply-chain campaign dubbed 'mini Shai Hulud' compromised four SAP Cloud Application Programming Model (CAP) npm packages by injecting a preinstall hook that downloads the Bun runtime and runs an obfuscated 11 MB second-stage payload which steals GitHub, npm, cloud (AWS/Azure/GCP), Kubernetes, and CI/CD secrets and self-propagates by republishing infected packages; researchers attribute the campaign to TeamPCP and publish affected package versions, tarball and dropper hashes alongside mitigation guidance (rotate secrets, audit CI/CD, block listed versions).