- 30th April 2026
A coordinated npm supply chain attack hit SAP’s Cloud Application Programming Model toolchain on April 29, 2026, branding itself “Mini Shai-Hulud.” Four packages totalling 570,000 weekly downloads were poisoned in a 2-hour window. The payload uses Bun as a runtime to evade Node.js detection, pulls 134 credential paths from infected hosts, dumps GitHub Actions runner memory, and persists through Claude Code SessionStart hooks and VS Code tasks.json folderOpen triggers. Over 1,197 victim repositories were live on GitHub within hours. Zero CVEs assigned.
Francesco Cipollone