Shai-Hulud Strikes SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework

On April 29, 2026 a supply-chain campaign compromised four SAP CAP npm packages by using malware delivered via a preinstall hook that installed a multi-stage obfuscated payload; the attacker leveraged a developer’s Claude Code GitHub integration to commit malicious workflow changes that executed the malware inside GitHub Actions, extracted an npm OIDC publish token, and published infected package versions that exfiltrate credentials, deploy persistence (Claude SessionStart hooks), and propagate via npm republishing and repository-resident droppers.