Malicious SAP npm Packages Target Crypto Wallet Data in Coordinated Attack

Security researchers uncovered a sophisticated malware campaign infiltrating SAP's developer ecosystem through compromised npm packages. The malicious versions—mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, and @cap-js/sqlite@2.2.2—collectively receive over 572,000 weekly downloads, posing systemic risk to credential storage and cryptocurrency wallets.

The attack vector leverages obfuscated JavaScript payloads delivered via modified package files, including a byte-identical loader script across all compromised packages. Notably, the malware avoids Russian-language systems and adapts its behavior based on environment detection—targeting both CI/CD platforms and developer workstations. Credential theft spans SSH keys, cloud service tokens, and cryptocurrency wallet data.