---
id: 2441
title: "Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/mini-shai-hulud-has-appeared"
published_at: "2026-04-29 00:00"
tags: ["supply-chain", "secrets", "malware", "credential-theft", "npm", "sap", "supply-chain-security", "bun", "circleci"]
phying_url: "https://phying.com/item/2441"
lang: en
---

# Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

## Summary

An npm supply chain attack hit SAP's ecosystem: @cap-js and mbt packages gained preinstall hooks running an 11.7 MB Bun-based credential stealer, likely seeded by a token leaked in a CircleCI PR build.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-04-29 00:00
- **Original:** https://www.aikido.dev/blog/mini-shai-hulud-has-appeared
- **Phying News:** https://phying.com/item/2441