# "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

DevFeed: ["A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages](<https://devfeed.tech/articles/a-mini-shai-hulud-has-appeared-bun-based-stealer-hits-sap-cap-js-and-mbt-npm-packages-7856.md>)

Original publisher: [Read original article](<https://snyk.io/blog/bun-based-stealer-hits-sap-cap-js-mbt-npm-packages/>)

Author: Stephen Thoemmes

Published: 2026-04-29T00:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [ecosystem](<https://devfeed.tech/tags/ecosystem.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [interest](<https://devfeed.tech/tags/interest.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [payload](<https://devfeed.tech/tags/payload.md>), [releases](<https://devfeed.tech/tags/releases.md>), [sap](<https://devfeed.tech/tags/sap.md>), [scm](<https://devfeed.tech/tags/scm.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [tech](<https://devfeed.tech/tags/tech.md>), [tool](<https://devfeed.tech/tags/tool.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

A supply-chain attack compromised four npm packages in the SAP development ecosystem. Malicious releases download Bun and execute an obfuscated credential stealer, while SAP published clean post-incident versions and Snyk issued advisories.

## Source excerpt

A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and what to do.