Official SAP npm Packages Compromised in TeamPCP Supply Chain Attack

Summary of the SAP npm Package Compromise

Security researchers have identified a targeted campaign affecting official SAP npm packages used widely in enterprise application development. According to BleepingComputer, several packages maintained by SAP were compromised to include malicious scripts designed to exfiltrate sensitive information from developer workstations. This incident is categorized as a Supply Chain Attack, leveraging the trust inherent in official software repositories to bypass traditional security perimeters.

The attack is attributed to a threat actor group known as TeamPCP. The compromise resulted in the modification of multiple packages, including @sap/cds, @sap/cds-dk, and @sap/hana-client. These packages are foundational for developers building on the SAP Business Technology Platform, meaning the potential impact extends to numerous high-value corporate environments. The primary objective of the attackers was the theft of credentials, authentication tokens, and environment variables which could facilitate further unauthorized access.

Technical Analysis of the TeamPCP Campaign

The TTPs employed by TeamPCP involve the injection of malicious code into the package.json file of the affected libraries. Specifically, the attackers utilized preinstall and postinstall hooks. These hooks allow arbitrary scripts to execute automatically when a developer runs commands such as npm install or npm update. Because these scripts run with the permissions of the user performing the installation, they can access sensitive files across the local system.

Once executed, the malicious code scans the developer’s environment for specific IoC indicators and sensitive data. This includes parsing .env files, which often contain database passwords and API keys, and searching for Git credentials stored in .git-credentials. The harvested data is then exfiltrated to a C2 server controlled by the attackers. This method is particularly effective as it occurs before many EDR solutions can inspect the running process, especially in development environments where security configurations may be less restrictive than production servers.

Identifying Compromised SAP npm Package Versions

To effectively detect SAP npm package compromise, security teams should perform a deep inspection of their internal package mirrors and local node_modules directories. The attackers targeted specific versions of the SAP packages, ensuring that the malicious code remained active for a window of time before being identified and pulled from the public npm registry. Security professionals should compare the SHA checksums of their installed packages against the verified versions published by SAP after the cleanup.

This incident aligns with MITRE ATT&CK technique T1195.002 (Supply Chain Compromise: Compromise Software Dependencies). By analyzing the TeamPCP supply chain attack patterns, analysts can see a preference for targeting enterprise-grade SDKs where a single compromise can yield access to dozens of downstream corporate environments.

Actionable Recommendations and Mitigation

Immediate action is required for any organization utilizing the SAP development ecosystem. The priority must be to remediate compromised npm dependencies and secure any potentially exposed secrets. If a compromised package version was installed, the developer workstation must be treated as fully compromised until a forensic review is completed.

1. Dependency Audit: Use tools like npm audit or specialized software composition analysis (SCA) platforms to identify the presence of the affected @sap package versions.
2. Credential Rotation: Assuming that exfiltration was successful, organizations should immediately rotate all credentials that were stored on developer machines, including Git tokens, SSH keys, and cloud service provider (CSP) secrets.
3. Network Monitoring: The SOC should review SIEM logs for outbound connections to unknown or suspicious domains immediately following any npm install events involving SAP packages.
4. Registry Lockdown: Implement a private npm registry (e.g., Verdaccio or Artifactory) that requires manual approval for new package versions before they are made available to the broader development team. This provides a buffer against sudden upstream compromises.