Update 1520 UTC, 30 April 2026: Two additional packages were trojanized today:

NPM Package: intercom-client@7.0.5

PyPI package lightning@2.6.2 and 2.6.3

Both packages appear to contain the same malicious functionality previously seen in the SAP operation. Analysis is ongoing.

Update 2140 UTC, 29 April 2026: Lightning and intercom-client payload analysis

Analysis of the malicious payloads shows an evolution in both exfiltration and credential harvesting techniques. In addition to earlier GitHub-based exfiltration, the malware now leverages dedicated infrastructure, primarily the domain zero.masscan.cloud, while also implementing a dynamic fallback mechanism.

The fallback retrieves configuration data from GitHub by searching for commits containing a specific keyword (“beautifulcastle”), which embeds a base64-encoded payload pointing to an exfiltration endpoint (currently resolving to 94.154.172[.]43/v1/telemetry. This approach allows attackers to update exfiltration infrastructure without publishing new malicious package versions.

The payload found in the intercom-client package further expands capabilities by actively scanning for secrets in Kubernetes environments and HashiCorp Vault. It queries Kubernetes service endpoints and Vault configurations, using extensive regex-based matching to extract credentials such as AWS keys, GitHub and npm tokens, database connection strings, private keys, and API secrets (e.g., Stripe, Slack, Twilio). This indicates a strong focus on cloud-native environments and CI/CD pipelines, significantly increasing the potential impact of the compromise through automated large-scale credential harvesting.

Update 1745 UTC, 29 April 2026: TeamPCP attribution confirmed and new functionality documented.

A new supply chain operation from TeamPCP calling itself “Mini Shai Hulud” compromised SAP-related npm packages by injecting malicious preinstall scripts that execute during dependency installation. The campaign leverages a multi-stage payload to harvest developer and CI/CD secrets across GitHub, npm, and major cloud providers, and exfiltrates the data via attacker-controlled GitHub repositories. It also contains code designed to propagate via compromised tokens. TeamPCP is very likely responsible for this campaign, based on a shared RSA public key and overlaps in encoding routines and region guardrails.

What happened?

Malicious versions of legitimate SAP ecosystem packages (e.g., `@cap-js/sqlite`, `@cap-js/postgres`) were created by modifying them to include a `preinstall` script that executes `setup.mjs` automatically during `npm install`. This script downloads the Bun runtime and executes an obfuscated payload (`execution.js`), enabling attacker-controlled code execution prior to package installation completion. 

When executed, the second-stage payload is a credential stealer and propagation framework designed to target both developer environments and CI/CD pipelines. It collects sensitive data including GitHub tokens, npm credentials, cloud secrets (AWS, Azure, GCP), Kubernetes tokens, and GitHub Actions secrets—leveraging advanced techniques such as extracting secrets from runner memory. Exfiltration occurs via public GitHub repositories, where it posts encrypted payloads. Additionally, the malware includes propagation logic to infect additional repositories and package distributions.

During its initial setup, the malware performs a system check to determine if the compromised machine is configured for the Russian language. It does this by inspecting both the system's date/time locale settings and its environment language variables. If any of these values begin with 'ru', the payload abruptly terminates itself, ensuring no data is exfiltrated from Russian-speaking systems.

While we estimate this campaign is currently active, the volume of compromised users and attacker-created exfiltration repositories appears significantly lower than that of Shai-Hulud or Shai-Hulud 2.0.

Notable Updates

This operation broadly follows the same methods used in previous TeamPCP operations, but contains a number of notable evolutions.

Github Exfiltration

In the Bitwarden operation, the malware would attempt to exfiltrate the encrypted blob of secrets to GitHub only if the primary exfiltration mechanism to a C&C domain failed. In this operation, exfiltration to GitHub is the primary and only way to exfiltrate secrets. The mechanisms are substantially similar, using the same naming scheme (word1-word2-number) and the same repo description “"Checkmarx Configuration Storage" The biggest change is that the SAP operation uses the GraphQL API, rather than the REST API, which was used in the Bitwarden operation.

Fallback to GitHub Poisoning

If the credential collection is not able to identify a gh[op]_ (PAT/OAuth) token and GITHUB_REPOSITORY is set it will attempt to poison that GitHub repository. It does this only if ghs_ or ghs_old tokens are present (and no GitHub PAT tokens are). The below files are placed in the repo, in an attempt to infect users who open the repo in Claude Code or VSCode:

Browser Credential Theft

The SAP operation adds the ability to steal credentials from multiple browsers (Chrome, Safari, Edge, Brave, Chromium) and exfiltrate any passwords found there. This feature was not present in any of the previous operations.

Exfiltration Fallback Mechanism

Consistent with previous Shai-Hulud attacks, this new variant utilizes a fallback mechanism to exfiltrate secrets from environments lacking local GitHub (GH) tokens or credentials. If local credential harvesting fails, the malware actively searches GitHub for commits beginning with a specific signature phrase: "OhNoWhatsGoingOnWithGitHub".

This phrase is the default commit message the malware uses when exfiltrating data. Appended to this phrase is a double-base64 encoded GitHub token:

Once located, the malware extracts and validates this token to facilitate further data exfiltration. Consequently, even if your organization has not created any new repositories, your secrets may still be compromised and routed to an entirely unrelated, attacker-controlled repository.

Attribution

Wiz assesses with high confidence that this is the work of the same TeamPCP operators that have previously compromised multiple libraries. This assessment is due to a shared RSA public key used to encrypt the exfiltrated secrets. This means that the same private key would decrypt the payloads, limiting the accessibility of the exfiltrated data to TeamPCP. 

Additional commonalities:

• The malware has an early check for the system language and if it is found to be “ru” the malware exits and does not exfiltrate any secrets. This was previously present in the Checkmarx and Bitwarden compromises.

• The package uses the same npm install hook to start execution that was used in the Bitwarden CLI compromise.

• GitHub based exfiltration to Dune themed repos was the fallback C2 method for the Bitwarden CLI operation, but is now the primary option.

While this operation contains references to the Shai-Hulud operations from the fall of 2025, we cannot definitively link them or say they are a separate actor.

Affected Packages 

npm packages:

• @cap-js/sqlite – v2.2.2

• @cap-js/postgres – v2.2.2

• @cap-js/db-service – v2.10.1

• mbt – v1.2.48

Indicators of compromise

@cap-js/postgres 2.2.2

@cap-js/db-service 2.10.1

@cap-js/sqlite 2.2.2

mbt 1.2.48

Shared Dropper (all 4 packages)

What steps should security teams take?

• Immediately identify exposure: Search environments, lockfiles, artifact stores, and CI logs for affected package versions and malicious files (setup.mjs, execution.js).

• Rotate all credentials: If exposure is suspected, rotate GitHub tokens, npm tokens, cloud credentials, Kubernetes tokens, and CI/CD secrets, this malware targets all of them.

• Audit GitHub activity: Look for suspicious commits, newly created repositories, or indicators such as the propagation keyword and unusual commit authors.

References

• Aikido blogpost

• Socket blogpost