SAP npm Packages targeted with Credential-stealing Malware

Threat Intel
,
1

So far, four SAP-related npm packages have been compromised where the preinstall scripts inject malicious preinstall hooks that bootstrap the Bun JavaScript runtime and executes an obfuscated credential stealer payload (execution.js). This happens during dependency installation and can be used to harvest developer and CI/CD secrets across GitHub, npm, and major cloud providers. The payload exfiltrates the data via attacker-controlled GitHub repositories.

So far, four SAP npm packages have been compromised:

  • mbt@1.2.48
  • @cap-js/sqlite@2.2.2
  • @cap-js/postgres@v2.2.2
  • @cap-js/db-service@v2.10.1

The repositories created by this malware carry a distinctive description hardcoded in the payload: “A Mini Shai-Hulud has Appeared”. At the time of writing, a public GitHub search for this string returns victim repositories being created in real time, each one representing a developer whose credentials were stolen:

https://github.com/search?q=%22A+Mini+Shai-Hulud+has+Appeared%22&type=repositories&p=6

4 Likes
2

Moved to Threat Intel because there are actionable indicators, and tagged appropriately. Also slight editing for preview card.

3 Likes
3

The repo names are in line with the Checkmarx compromise and Bitwarden:

4

Just to save a click, here are the GitHub-based IoCs.

Repo message: A Mini Shai-Hulud has Appeared (mind the capitals)

Repo name regex:

(sardaukar|mentat|fremen|atreides|harkonnen|gesserit|prescient|
fedaykin|tleilaxu|siridar|kanly|sayyadina|ghola|powindah|prana|
kralizec)-(sandworm|ornithopter|heighliner|stillsuit|lasgun|sietch|
melange|thumper|navigator|fedaykin|futar|slig|phibian|laza|cogitor|
ghola)-\d{1,3}
5

Attacking SAP is rude but also so very specific? I can’t think of many other business critical applications that are so sprawling and difficult to monitor.