Supply Chain Attack "Mini Shai-Hulud" Hits 1,800 Developers Across SAP, Lightning, and Intercom

"Mini Shai-Hulud" attack by TeamPCP hits 1,800+ developer repos, injecting malware into SAP and intercom packages, risking major credential theft.

By Content Team

May 2, 2026

ON THIS PAGE

A sweeping supply chain attack dubbed "Mini Shai-Hulud," linked to the TeamPCP hacking group, has compromised over 1,800 developer repositories since April 29. Malicious versions of SAP NPM packages, Lightning PyPi (v2.6.2–2.6.3), intercom-client NPM (v7.0.4–7.0.5), and intercom-php (v5.0.2) were injected with credential-stealing malware. The malware harvests AWS keys, API tokens, VPN credentials, crypto wallet data, and more, exfiltrating it to GitHub repos and a dedicated domain. The payload also actively scans Kubernetes environments and HashiCorp Vault secrets. With the affected packages totaling nearly 30 million downloads combined, the blast radius could grow significantly.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?