Four official SAP npm packages hit by supply chain attack

Researchers at Aikido have identified four official SAP npm packages affected by a new supply chain attack variant. The packages relate to SAP's Cloud Application Programming Model and its MTA deployment model for enterprise cloud applications. The attack resembles earlier Shai-Hulud campaigns: a malicious preinstall script downloads the Bun JavaScript runtime and uses it to execute code from a bundled execution.js. The malware harvests credentials for SSH, npm, GitHub and cloud platforms, then exfiltrates the data by creating a public GitHub repository. The affected versions are @cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, @cap-js/db-service 2.10.1 and mbt 1.2.48. The packages were removed quickly.

What this means for your organisation

The SAP ecosystem is used by large Norwegian enterprises, and packages from it tend to pass without question because they come from an established vendor. When the malware runs at install time, it hits developer machines and build servers directly, and that is where the keys to production live. Exfiltration via a public GitHub repository also means stolen secrets may have been openly available for a period.

Berigo recommends

• Search your projects and lockfiles for the four listed versions, including older branches.
• Rotate SSH keys, npm and GitHub tokens and cloud credentials on machines that may have installed the packages.
• Disable install script execution in builds, and require approval for new dependency versions.
• Set up monitoring that catches unexpected public repositories being created under your organisation's GitHub accounts.

Source

• aikido.dev
• socket.dev