PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

aikido.dev | blog | #supply-chain | #secrets | #malware | #credential-theft | #npm | #sap | #supply-chain-security | #bun | #circleci
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An npm supply chain attack hit SAP's ecosystem: @cap-js and mbt packages gained preinstall hooks running an 11.7 MB Bun-based credential stealer, likely seeded by a token leaked in a CircleCI PR build.
Published
Collected

Related coverage

blog · wiz.io
Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware
TeamPCP's 'Mini Shai Hulud' campaign trojanized SAP-related npm packages with preinstall scripts, later hitting intercom-client and lightning, harvesting Kubernetes, Vault, and cloud credentials.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Wiz: keyv/cacheable packages were hijacked via a maintainer account; a Mini Shai-Hulud descendant hit 400+ packages, stealing credentials, AI configs and wallets; C2 via an Ethereum contract.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
Back