SAP npm packages compromised in Mini Shai-Hulud software supply-chain attack

On 29 April 2026, malicious versions of four open-source packages associated with SAP's Cloud Application Programming Model and MTA build tooling were distributed through npm. SAP confirmed that the packages contained malware capable of exposing credentials and that anyone who downloaded the affected releases could have been impacted. Security analyses found credential-harvesting and self-propagation functionality capable of compromising developer environments and additional software repositories. Clean package versions replaced the malicious releases within hours, but the trusted SAP distribution channel had already been poisoned, creating a material software-supply-chain data-integrity impact.