# Official SAP npm Packages Compromised in TeamPCP Supply Chain Attack

> Attackers compromised official SAP npm packages to exfiltrate developer credentials and tokens. Learn how to detect and remediate this supply chain threat.

- Published: 2026-04-30T00:50:55.000Z
- Severity: high
- Category: Supply Chain
- Tags: SAP, NPM, TeamPCP, Credential Theft, Malicious Packages
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/official-sap-npm-packages-compromised-to-steal-credentials/
- Canonical: https://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attack

## Key points

- Attackers compromised official SAP npm packages to steal developer credentials, environment variables, and authentication tokens through malicious install scripts.
- Affected packages include official SAP libraries such as @sap/cds and @sap/cds-dk used in corporate development environments.
- Organizations must immediately audit their dependency trees, rotate all developer credentials, and verify the integrity of local npm registries.

## Summary of the SAP npm Package Compromise

Security researchers have identified a targeted campaign affecting official SAP npm packages used widely in enterprise application development. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/official-sap-npm-packages-compromised-to-steal-credentials/), several packages maintained by SAP were compromised to include malicious scripts designed to exfiltrate sensitive information from developer workstations. This incident is categorized as a [Supply Chain Attack](/glossary#supply-chain-attack), leveraging the trust inherent in official software repositories to bypass traditional security perimeters.

The attack is attributed to a threat actor group known as TeamPCP. The compromise resulted in the modification of multiple packages, including `@sap/cds`, `@sap/cds-dk`, and `@sap/hana-client`. These packages are foundational for developers building on the SAP Business Technology Platform, meaning the potential impact extends to numerous high-value corporate environments. The primary objective of the attackers was the theft of credentials, authentication tokens, and environment variables which could facilitate further unauthorized access.

## Technical Analysis of the TeamPCP Campaign

The [TTP](/glossary#ttp)s employed by TeamPCP involve the injection of malicious code into the `package.json` file of the affected libraries. Specifically, the attackers utilized `preinstall` and `postinstall` hooks. These hooks allow arbitrary scripts to execute automatically when a developer runs commands such as `npm install` or `npm update`. Because these scripts run with the permissions of the user performing the installation, they can access sensitive files across the local system.

Once executed, the malicious code scans the developer's environment for specific [IoC](/glossary#ioc) indicators and sensitive data. This includes parsing `.env` files, which often contain database passwords and API keys, and searching for Git credentials stored in `.git-credentials`. The harvested data is then exfiltrated to a [C2](/glossary#c2) server controlled by the attackers. This method is particularly effective as it occurs before many [EDR](/glossary#edr) solutions can inspect the running process, especially in development environments where security configurations may be less restrictive than production servers.

### Identifying Compromised SAP npm Package Versions

To effectively **detect SAP npm package compromise**, security teams should perform a deep inspection of their internal package mirrors and local `node_modules` directories. The attackers targeted specific versions of the SAP packages, ensuring that the malicious code remained active for a window of time before being identified and pulled from the public npm registry. Security professionals should compare the SHA checksums of their installed packages against the verified versions published by SAP after the cleanup.

This incident aligns with [MITRE ATT&CK](/glossary#mitre-att-ck) technique T1195.002 (Supply Chain Compromise: Compromise Software Dependencies). By analyzing the **TeamPCP supply chain attack patterns**, analysts can see a preference for targeting enterprise-grade SDKs where a single compromise can yield access to dozens of downstream corporate environments.

## Actionable Recommendations and Mitigation

Immediate action is required for any organization utilizing the SAP development ecosystem. The priority must be to **remediate compromised npm dependencies** and secure any potentially exposed secrets. If a compromised package version was installed, the developer workstation must be treated as fully compromised until a forensic review is completed.

1.  **Dependency Audit**: Use tools like `npm audit` or specialized software composition analysis (SCA) platforms to identify the presence of the affected `@sap` package versions. 
2.  **Credential Rotation**: Assuming that exfiltration was successful, organizations should immediately rotate all credentials that were stored on developer machines, including Git tokens, SSH keys, and cloud service provider (CSP) secrets.
3.  **Network Monitoring**: The [SOC](/glossary#soc) should review [SIEM](/glossary#siem) logs for outbound connections to unknown or suspicious domains immediately following any `npm install` events involving SAP packages.
4.  **Registry Lockdown**: Implement a private npm registry (e.g., Verdaccio or Artifactory) that requires manual approval for new package versions before they are made available to the broader development team. This provides a buffer against sudden upstream compromises.

**Related:** [SAP npm Packages Compromised by “Mini Shai-Hulud” Malware](/blog/sap-npm-packages-compromised-by-mini-shai-hulud-malware), [TeamPCP Supply Chain: Checkmarx KICS, Bitwarden CLI, xinference PyPI Attacks](/blog/teampcp-supply-chain-checkmarx-kics-bitwarden-cli-xinference-pypi-attacks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attack