Official SAP npm packages compromised to steal credentials

Multiple official SAP npm packages were compromised in a supply-chain attack that added a malicious preinstall script which installs a runtime and executes an obfuscated information-stealer. The malware harvests developer and CI credentials (npm/GitHub tokens, SSH keys, cloud credentials, Kubernetes secrets), scrapes CI runner memory for masked secrets, uploads encrypted exfiltrated data to attacker-controlled GitHub repositories, and attempts to self-propagate by modifying other packages; researchers link the incident to the TeamPCP group.