---
id: 6854
title: "Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm"
published_at: "2026-04-29T15:14:27Z"
tags: ["cloud", "supply-chain", "kubernetes", "malware", "credential-theft", "npm", "sap", "teampcp"]
phying_url: "https://phying.com/item/6854"
lang: en
---

# Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware

## Summary

TeamPCP's 'Mini Shai Hulud' campaign trojanized SAP-related npm packages with preinstall scripts, later hitting intercom-client and lightning, harvesting Kubernetes, Vault, and cloud credentials.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-04-29T15:14:27Z
- **Original:** https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
- **Phying News:** https://phying.com/item/6854