Mini Shai-Hulud: npm Worm Hits SAP Developer Packages | Blog | Endor Labs
Four SAP npm packages were weaponized to steal GitHub, cloud, and AI coding tool secrets. The malware uses Bun to slip past Node-based detection.
A Mini Shai-Hulud Has Appeared: Obfuscated Bun Runtime Payloads Hit SAP-Related npm Packages - StepSecurity
stepsecurity.ioStepSecurity has detected a new npm supply chain attack campaign using preinstall hooks to download the Bun JavaScript runtime and execute an 11 MB obfuscated payload. At least two SAP-ecosystem packages are confirmed compromised so far.
AI Agent Config Security Is Supply Chain Security
AI agent config security belongs in supply-chain review: hooks, editor tasks, install scripts, MCP files, and plugins can execute code before you notice.
The Good, the Bad and the Ugly in Cybersecurity – Week 18
Authorities dismantle cybercrime rings, scammers extract billions using social media, and threat actors poison SAP-related npm packages.