# Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads

DevFeed: [Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads](<https://devfeed.tech/articles/chainguard-artifacts-safe-from-npm-supply-chain-attack-targeting-sap-developer-dependencies-with-2-25m-monthly-downloads-12929.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-npm-supply-chain-attack-targeting-sap-developer-dependencies>)

Published: 2026-04-29T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>)

Tags: [bun](<https://devfeed.tech/tags/bun.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [github](<https://devfeed.tech/tags/github.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [sap](<https://devfeed.tech/tags/sap.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

A Shai-Hulud-style npm supply-chain attack compromised four SAP Cloud Application Programming Model dependencies with more than 2.25 million combined monthly downloads. The malicious packages used a preinstall hook to download Bun and harvest GitHub tokens, npm tokens, and other developer secrets. Chainguard customers were protected because Chainguard Libraries for JavaScript does not build or serve packages containing install-time scripts, and Chainguard Factory terminated rebuilds when it detected the hook.

## Source excerpt

New npm worm targets 2.25M-download packages. Chainguard customers stayed protected by blocking install-time scripts and malicious dependencies.