Overview
- Four SAP ecosystem packages briefly shipped tainted versions Wednesday between 09:55 and 12:14 UTC before maintainers pulled them and published clean replacements.
- The compromised releases added a preinstall script that fetched the Bun runtime to run an obfuscated payload that scanned developer machines and CI runners for tokens and cloud keys, and it exited on Russian‑locale systems.
- Stolen data was encrypted and pushed to new public GitHub repositories on victims’ accounts labeled “A Mini Shai-Hulud has Appeared,” providing a visible sign that secrets may have leaked.
- The malware tried to spread by using stolen GitHub and npm tokens to modify repositories and release workflows, and it planted VS Code and Claude Code config files that execute when a repo is opened.
- Wiz and other firms link the campaign to TeamPCP and report a likely publishing path through a compromised maintainer account and misuse of GitHub OIDC tokens in CircleCI, while urging teams to search for setup.mjs and execution.js, audit CI and GitHub activity, and rotate GitHub, npm, cloud and Kubernetes credentials.