SAP CAP packages hit by Mini Shai-Hulud

On April 29, 2026, four npm packages from SAP's open-source Cloud Application Programming ecosystem were republished carrying the same credential-stealing loader that researchers at StepSecurity had begun calling Mini Shai-Hulud. SAP's CAP framework is the enterprise software vendor's preferred toolkit for building cloud services on Node.js, so the affected packages sit deep inside customer build pipelines.

The compromised releases were mbt@1.2.48, @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, and @cap-js/db-service@2.10.1. Each shipped a preinstall hook pointing at setup.mjs, which downloaded the Bun JavaScript runtime at version 1.3.13 from GitHub releases and used it to execute an 11.6 MB obfuscated payload named execution.js. The underlying packages continued to work, which kept the install quiet while the payload ran.

The two publish paths differed in instructive ways. The mbt release went out under a stolen static npm automation token belonging to the cloudmtabot account that normally handles that package, StepSecurity said. The three @cap-js releases came through a more elaborate route: a compromised SAP developer account modified the release workflow in cap-js/cds-dbs to exchange a GitHub OIDC token for an npm token through trusted publishing, then ran the publish from a non-main branch. Trusted publishing was meant to eliminate long-lived secrets; here the attacker turned the trust relationship itself into the delivery channel.

Once running, the payload harvested developer and CI secrets, read GitHub Actions runner memory for masked values, created dead-drop GitHub repositories titled "A Mini Shai-Hulud has Appeared" to hold exfiltrated data, and wrote persistence hooks into editor and agent configuration files including .claude/settings.json and .vscode/tasks.json. SAP and the cap-js maintainers pulled the affected versions; @cap-js/postgres was unpublished from npm outright. The shared worm machinery across the wave is tracked under the broader TeamPCP campaign, while this record holds the SAP-specific artifacts.