SAP

Disclosed Apr 29, 2026Unverified

Official SAP npm packages trojanized to steal developer credentials

Malicious versions of official SAP npm packages, including @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service and mbt, ran a preinstall script that stole npm, GitHub, cloud and Kubernetes secrets from developers. Researchers linked the attack to TeamPCP; SAP did not comment.

What is known

People affected	Not stated in the sources we have
Disclosed	Apr 29, 2026
Attack	Supply chain
Data exposed	Credentials and tokensAPI keys
Sector	Tech · DE
Status	Unverified: not yet confirmed by an official notice, a filing or the organization

Sources

Newsbleepingcomputer.com

Official SAP npm packages compromised to steal credentials

Notices filed

TotalApr 29

ResearchCount not stated

Other breaches at SAP

SAPwned: SAP AI Core flaws gave researchers access to customer cloud keys and AI artifactsExposed data exposed credentials and tokens, API keys and training data.Exposed dataTechDEUnverifiedJul 17, 2024

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about SAP