Mini Shai‑Hulud: Bun‑Based Stealer in SAP npm Packages
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
Microsoft Sentinel (KQL)
