Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

A supply-chain campaign compromised several npm packages used in the SAP developer ecosystem (`@cap-js/[email protected]`, `@cap-js/[email protected]`, `@cap-js/[email protected]`, `[email protected]`) by adding a `preinstall` script that downloads Bun and runs an obfuscated payload (`execution.js`) which harvests developer, CI, GitHub, npm and cloud credentials, scrapes GitHub runner memory, and exfiltrates encrypted results via public GitHub repositories (repositories labeled with the description "A Mini Shai-Hulud has Appeared"); the report includes hashes, markers, URLs, IOCs, likely initial access via a CircleCI PR build, propagation logic, and recommended detection and secret-rotation mitigations.