SAP npm Packages Compromised to Steal Developers, CI/CD Secrets

**Executive summary:** A sophisticated supply‑chain campaign attributed to TeamPCP has been found injecting malicious preinstall hooks into SAP npm packages (notably @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48) to execute a multi‑stage credential‑stealing payload that harvests GitHub, npm, cloud, Kubernetes, CI/CD, and browser credentials and exfiltrates encrypted data to GitHub repositories via the GraphQL API; the operation includes a Russian‑locale kill‑switch, repository‑poisoning fallback, and multiple attribution overlaps with prior TeamPCP activity.