SAP NPM PACKAGES COMPROMISED IN CREDENTIAL THEFT ATTACK

SAP has confirmed that several of its official npm packages were compromised, likely as part of a coordinated supply-chain attack. The threat actor group TeamPCP is believed responsible for injecting malicious code designed to harvest credentials and authentication tokens from affected developers' systems. ■ What Happened The compromised packages were distributed through the official npm repository, giving the attack broad potential reach across SAP's developer community. By positioning malicious code within trusted, official packages, attackers exploited the implicit trust developers place in vendor-supplied dependencies. The injected code targeted sensitive authentication materials, including API keys, session tokens, and credential files commonly stored on developer machines. Such access could enable further unauthorized access to internal systems and development environments. ■ Scope and Response SAP has not publicly disclosed the exact number of compromised packages or the total number of affected installations. The company has begun notifying impacted users and has removed malicious versions from the npm registry. Developers who installed affected packages are advised to: - Rotate all credentials and authentication tokens - Review access logs for suspicious activity - Update to patched package versions - Audit systems for signs of unauthorized access ■ Broader Context This incident underscores persistent vulnerabilities in software supply chains. Even official packages from major vendors can be compromised, as demonstrated by previous attacks on popular npm packages. The JavaScript ecosystem, with its massive dependency graphs and frequent updates, remains a significant attack surface. Organizations relying on npm dependencies should implement stricter controls, including dependency scanning, version pinning, and regular security audits. The incident reinforces that vendor reputation alone provides insufficient protection against determined attackers.