Executive Summary
A sophisticated supply-chain attack named 'Mini Shai-Hulud' has compromised several SAP-related npm packages, including `@cap-js/sqlite` and `mbt`. The attack leverages a `preinstall` hook to download the Bun JavaScript runtime and execute a large, obfuscated credential-stealing payload. The infection likely originated from exposed npm tokens via compromised CircleCI pull request builds.
The malware targets highly sensitive developer environments and CI/CD runners to harvest GitHub tokens, npm credentials, cloud secrets (AWS, Azure, GCP), and Kubernetes service account tokens. It features advanced techniques such as memory dumping of GitHub Runner processes and utilizes public GitHub repositories as encrypted exfiltration channels, marked by the description 'A Mini Shai-Hulud has Appeared'.
This campaign represents a significant risk to organizations using SAP CAP and Cloud MTA build tools. Compromised credentials can lead to broader cloud environment takeovers and further propagation of malicious code within internal repositories and automated release workflows.