The threat actor known as TeamPCP has expanded its ongoing supply chain attack campaign to target npm packages used in SAP's cloud application development ecosystem. The new campaign, dubbed "Mini Shai-Hulud," follows the group's previous attacks on widely-used development tools and infrastructure packages, and represents a continued escalation in the breadth and sophistication of their supply chain operations.
TeamPCP's Expanding Campaign
TeamPCP first gained prominence through a series of high-profile supply chain attacks targeting developer tooling, CI/CD infrastructure, and open-source packages. The group has demonstrated a consistent pattern: identify widely-used packages in enterprise development ecosystems, compromise maintainer accounts or package repositories, and inject malicious code that propagates credential-stealing or persistence mechanisms into dependent projects.
The "Mini Shai-Hulud" campaign follows this playbook, directing attention toward SAP's cloud application development toolchain — a ecosystem used by enterprise developers building applications on SAP's Business Technology Platform (BTP) and related cloud services.
SAP npm Packages Compromised
Multiple npm packages within SAP's cloud application development ecosystem were confirmed compromised. SAP's cloud tooling is widely adopted in enterprise environments, particularly in finance, manufacturing, and logistics sectors, where SAP's enterprise resource planning (ERP) systems serve as critical business infrastructure.
The malicious modifications introduced by TeamPCP into the SAP-related npm packages follow the group's established techniques, which have included credential harvesting, environment variable exfiltration, and the deployment of persistent implants into developer build environments and CI/CD pipelines.
What the "Mini Shai-Hulud" Name Suggests
The campaign name is a reference to the fictional giant sandworms from Frank Herbert's Dune — creatures known for propagating beneath the surface before erupting destructively. The "mini" designation may indicate this is a smaller-scale or reconnaissance-phase attack compared to a broader campaign the group may be planning, or it may simply reflect the targeted scope of the SAP ecosystem compared to the group's larger prior campaigns.
Security researchers tracking TeamPCP note the group frequently names operations in ways that hint at their perceived scale or methodology, making the name a possible signal of intent for future escalation.
Impact and Risk
The compromise of SAP ecosystem npm packages poses direct risks to organizations using these tools:
- Developer machine compromise — Malicious code executes during local development, exfiltrating credentials, API keys, and cloud tokens from developer workstations
- CI/CD pipeline infection — Build systems that install the compromised packages ingest the malicious payload, potentially exposing secrets stored in pipeline environments
- SAP cloud credentials at risk — Environment variables and configuration files for SAP BTP services may be targeted, enabling attackers to access enterprise SAP deployments
- Lateral movement — Credentials harvested from developer environments can be used to pivot into production SAP systems, cloud infrastructure, or connected enterprise services
Recommended Response
Organizations using SAP cloud development tooling and the affected npm packages should take immediate action:
- Audit package versions — Review
package.jsonand lock files for the compromised SAP npm packages and verify installed versions against known-good hashes - Check for malicious code — Inspect recently installed or updated SAP-related npm packages for unexpected dependencies or obfuscated code additions
- Rotate all credentials — Treat any credentials, API keys, or cloud tokens that may have been present in environments where the compromised packages were installed as potentially compromised
- Audit CI/CD pipelines — Review pipeline configurations and secrets management for signs of unauthorized access or exfiltration
- Monitor SAP BTP access logs — Check SAP Business Technology Platform access logs for anomalous authentication events or API calls
- Pin dependencies — Implement package integrity checking with subresource integrity hashes or Sigstore-based signing for all critical npm dependencies
Broader TeamPCP Context
TeamPCP's campaign is part of a broader trend of sophisticated supply chain attacks targeting enterprise development ecosystems. The group has been linked to earlier attacks on security tooling, cloud SDKs, and CI/CD packages. Their targeting of SAP-adjacent tooling represents a deliberate choice to move up the value chain — from general developer tooling toward packages embedded in high-value enterprise environments where compromised credentials unlock access to critical business systems.
Security teams at organizations with significant SAP footprints should treat this campaign as high priority and initiate a full review of their SAP cloud development toolchain dependencies.