What exactly happened?

On 29 April 2026, four official SAP software packages were infected with malware on the npmjs.com platform. The attackers call themselves “TeamPCP” and named the operation “Mini Shai-Hulud” (a reference to the worms from the science-fiction novel “Dune”).

The packages are core building blocks for SAP cloud development and are downloaded over 2.2 million times a month combined:

Affected packages and versions:

⚠ @cap-js/sqlite version 2.2.2
⚠ @cap-js/postgres version 2.2.2
⚠ @cap-js/db-service version 2.10.1
⚠ mbt (Cloud MTA Build Tool) version 1.2.48

Window: approx. 2–4 hours on 29 April 2026

SAP cleaned up the packages within a few hours and published Security Note 3747787 on 30 April.

What does the malware do?

As soon as one of the infected packages is downloaded, the following happens – automatically and invisibly:

  1. A hidden script runs on download (not only when used)
  2. It downloads an additional runtime (“Bun”)
  3. An 11-megabyte obfuscated payload scans the machine for credentials
  4. Data found is encrypted – only the attacker can read it
  5. The data is uploaded to the victim's GitHub repositories
  6. Using stolen tokens, the worm tries to spread into further packages
In SAP terms: the attack is comparable to a virus that spreads via SAP transports and, on every import, automatically reads all RFC passwords and service-user credentials and sends them to the attacker. Except that here it is not about the SAP system itself, but about the machine on which development happens.

What gets stolen?

  • GitHub credentials – access to your source code
  • npm tokens – the attacker can publish packages in your name
  • AWS access keys – access to your Amazon cloud
  • Azure and Google Cloud credentials – access to Microsoft/Google cloud
  • SSH keys – access to servers
  • SAP BTP service keys – access to your SAP cloud services
  • Environment variables – often containing database passwords and API keys

Am I affected? How to check

Ask your development team (or your external BTP provider):

  1. “Did we run npm install anywhere on 29 April – manually or automated?”
  2. “Do we use the packages @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service or mbt?”
  3. “Do we have automated build pipelines that run regularly?”
Important: even if no human was actively working that day – automated systems (build servers, nightly builds, Docker container builds) could have downloaded the packages in the background. Ask explicitly about automated processes!

Technical checks (for your development team):

  • Search all package-lock.json for the four affected versions
  • Check container images, build caches and artifact repositories
  • Compare SHA-512 hashes against SAP Note 3747787
  • Check GitHub repos for branches named shai-hulud
  • Workflow-Dateien: .github/workflows/discussion.yaml oder shai-hulud-workflow.yml
  • Look for self-hosted runners named “SHA1HULUD”
  • Commits with the signature “OhNoWhatsGoingOnWithGitHub:[Base64]”

What do I need to do NOW?

CRITICAL: uninstalling or downgrading alone is NOT enough. The malicious code can use persistence mechanisms that survive a package downgrade – for example in IDE configurations. SAP recommends completely re-imaging affected systems.

Step 1: Check

Search all lockfiles, container images, build caches and artifact repositories for the four affected package versions.

Step 2: Isolate

Immediately disconnect affected developer machines and build servers from the network.

Step 3: Rebuild

Completely re-image affected systems. Don't just delete the package.

Step 4: Rotate all credentials

Treat every credential on affected systems as compromised: GitHub tokens, npm tokens, AWS/Azure/GCP keys, SSH keys, SAP BTP service keys, all passwords in environment variables.

Step 5: Check cloud logs

Check AWS CloudTrail, Azure Activity Logs and GCP Audit Logs for unusual API calls from developer IPs or build servers.

Step 6: Apply updates

Update to the cleaned package versions.

Not sure where to start? We offer a 48-hour Rapid Assessment in which we check your SAP development environment for traces of the attack. Request it now →

How do I protect myself in future?

For SAP Basis teams – what to tell your development team:

“Make sure automatic script execution on package downloads is disabled (npm config set ignore-scripts true), that package versions are pinned, and that sensitive credentials live in a credential manager, not in environment variables.”
  • ignore-scripts: npm config set ignore-scripts true
  • Lockfiles: npm ci instead of npm install
  • OIDC: trusted publishers only for individual workflows, not entire repos
  • Credential management: no secrets in environment variables
  • Monitoring: GitHub search for “A Mini Shai-Hulud has Appeared” as an early warning

Technical details

Attack:              Mini Shai-Hulud (TeamPCP)
Date:                29 April 2026
SAP Note:            3747787
Affected packages:   4 npm packages (SAP CAP + MTA)
Downloads/month:     ~2.2 million (combined)
Victims (known):     1,800+ GitHub repos compromised
Payload:             execution.js (11 MB, obfuscated)
Encryption:          AES-256-GCM + RSA-4096
Exfiltration:        victim's GitHub repos
Self-propagation:    Yes (via stolen npm tokens)
Anti-analysis:       Inactive under Russian language
SAP component:       BC-XS-CDX-NJS
Supply ChainSAP CAPSAP BTPnpmMTA Build ToolCredential TheftTeamPCPNote 3747787