FAQ MiniShai Hulud npm Developer Package
SAP open-source NPM Developer Package malware incident response frequently asked questions. Laste ned dokumentet© 2026 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 1 / 4
PUBLIC
Frequently Asked Questions
Mini Shai Hulud npm Developer Package Supply Chain Attack
SAP Global Security & Cloud Compliance
Q2 2026
PUBLIC
Frequently Asked Questions
Mini Shai Hulud npm Developer Package Supply Chain Attack
SAP Global Security & Cloud Compliance
Q2 2026
© 2026 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2 / 4
Question? What happened?
On April 29, 2026, SAP open-source NPM packages were compromised with
malware leading to the potential exfiltration of information, including credentials.
These packages were publicly available for download to anyone with access to
the NPM registry.
Question? What are the compromised npm package versions?
Please refer to SAP note 3747787 for the list of compromised and patched npm
packages.
Question? What is the impact on affected SAP customers?
Given the nature of open-source software, the impact may go beyond SAP
customers. Anyone who may have downloaded the identified packages may have
been impacted.
Question? When did SAP notify customers about this issue?
SAP released the HotNews Security Note on April 29, 2026 19:30:23 UTC.
Question? How/When will I get more information?
Please ensure you are subscribed to our HotNews notifications and monitor SAP
Note 3747787 – “Malicious open-source packages in SAP Cloud Application
Programming Model & MTA Build Tool”
Question? Are there any actions customers should take?
If customers are uncertain whether their systems have been affected, it is critical to
act promptly. Please begin by following the investigative steps outlined in Security
Note 3747787 to determine whether you have been impacted and if so, how to
remediate.
Promptly taking these actions will help protect systems from potential risks.
Question? What mitigation steps is SAP taking to limit any negative impact on
customer data?
SAP is following the guidance set forth in the April 29 Security Note. We encourage
all external parties (customers, partners, developer, etc.) to do the same.
Question? What happened?
On April 29, 2026, SAP open-source NPM packages were compromised with
malware leading to the potential exfiltration of information, including credentials.
These packages were publicly available for download to anyone with access to
the NPM registry.
Question? What are the compromised npm package versions?
Please refer to SAP note 3747787 for the list of compromised and patched npm
packages.
Question? What is the impact on affected SAP customers?
Given the nature of open-source software, the impact may go beyond SAP
customers. Anyone who may have downloaded the identified packages may have
been impacted.
Question? When did SAP notify customers about this issue?
SAP released the HotNews Security Note on April 29, 2026 19:30:23 UTC.
Question? How/When will I get more information?
Please ensure you are subscribed to our HotNews notifications and monitor SAP
Note 3747787 – “Malicious open-source packages in SAP Cloud Application
Programming Model & MTA Build Tool”
Question? Are there any actions customers should take?
If customers are uncertain whether their systems have been affected, it is critical to
act promptly. Please begin by following the investigative steps outlined in Security
Note 3747787 to determine whether you have been impacted and if so, how to
remediate.
Promptly taking these actions will help protect systems from potential risks.
Question? What mitigation steps is SAP taking to limit any negative impact on
customer data?
SAP is following the guidance set forth in the April 29 Security Note. We encourage
all external parties (customers, partners, developer, etc.) to do the same.
© 2026 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 3 / 4
Question? What is the function of these NPM packages?
Two different components were impacted: CAP and MTA.
CAP (Cloud Application Programming Model) is SAP’s open-source
framework for building enterprise cloud applications in a fast, consistent,
and maintainable way.
CAP helps developers define business data and services once, and then
automatically handles most of the plumbing (CRUD logic, APIs, security
integration, database access, and cloud readiness) so teams can focus on
business logic.
MTA (Multi-Target Application) is SAP’s packaging and deployment model
for cloud applications.
MTA describes, builds, and deploys a complete application landscape as
one unit, even though it consists of multiple technologies (UI, backend
services, databases, destinations, jobs, etc.).
Question? What should I do if I am impacted/compromised?
Follow the steps as set forth explicitly in the Security Note (located in appendix).
Appendix
Solution from Security Note 3747787
If you have identified that you may be affected, perform the following measures:
Isolate affected systems: Disconnect the affected developer machine or CI/CD runner from the
network. Quarantine any affected system and consider steps such as re-imaging
them or deleting affected packages (including from package caches, lockfiles and
global node_modules) depending on your forensic workflow. Uninstalling or downgrading alone
may leave other malicious changes, such as IDE configuration changes, in place.
Rotate All Secrets: This is crucial. Assume that all secrets reachable from an infected system are
compromised, including, for example:
SSH Keys, GitHub tokens and grants, NPM tokens, GitHub Actions secrets, and Personal Access
Tokens.
AWS, Azure, and GCP credentials (including machine identity network endpoints),
Kubernetes / Docker / Terraform / Helm / Ansible / FileZilla secrets, password
manager credentials and various environment variables.
Other secrets related to e.g. Claude, MCP, messaging applications, crypto-currency wallets, and
VPN configurations.
Question? What is the function of these NPM packages?
Two different components were impacted: CAP and MTA.
CAP (Cloud Application Programming Model) is SAP’s open-source
framework for building enterprise cloud applications in a fast, consistent,
and maintainable way.
CAP helps developers define business data and services once, and then
automatically handles most of the plumbing (CRUD logic, APIs, security
integration, database access, and cloud readiness) so teams can focus on
business logic.
MTA (Multi-Target Application) is SAP’s packaging and deployment model
for cloud applications.
MTA describes, builds, and deploys a complete application landscape as
one unit, even though it consists of multiple technologies (UI, backend
services, databases, destinations, jobs, etc.).
Question? What should I do if I am impacted/compromised?
Follow the steps as set forth explicitly in the Security Note (located in appendix).
Appendix
Solution from Security Note 3747787
If you have identified that you may be affected, perform the following measures:
Isolate affected systems: Disconnect the affected developer machine or CI/CD runner from the
network. Quarantine any affected system and consider steps such as re-imaging
them or deleting affected packages (including from package caches, lockfiles and
global node_modules) depending on your forensic workflow. Uninstalling or downgrading alone
may leave other malicious changes, such as IDE configuration changes, in place.
Rotate All Secrets: This is crucial. Assume that all secrets reachable from an infected system are
compromised, including, for example:
SSH Keys, GitHub tokens and grants, NPM tokens, GitHub Actions secrets, and Personal Access
Tokens.
AWS, Azure, and GCP credentials (including machine identity network endpoints),
Kubernetes / Docker / Terraform / Helm / Ansible / FileZilla secrets, password
manager credentials and various environment variables.
Other secrets related to e.g. Claude, MCP, messaging applications, crypto-currency wallets, and
VPN configurations.
© 2026 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 4 / 4
Remove Workflow Branches: Check for and eliminate any injected workflow branches that might
have been added by the compromised packages.
Clean IDE configurations: Check for and eliminate any changes in IDE configurations which may
have been committed to other repositories available on the system as well.
Audit npm Packages: Conduct a thorough audit of your npm packages. If you notice any
unexpected version bumps, consider those versions malicious and unpublish them.
Delete Unauthorized Repositories: Look for and delete any unauthorized GitHub repositories,
especially those with Dune-themed names or matching the indicators mentioned above.
Pin Exact Versions: To prevent silent upgrades to malicious patch releases, make sure to pin
exact versions of your npm packages.
###
Remove Workflow Branches: Check for and eliminate any injected workflow branches that might
have been added by the compromised packages.
Clean IDE configurations: Check for and eliminate any changes in IDE configurations which may
have been committed to other repositories available on the system as well.
Audit npm Packages: Conduct a thorough audit of your npm packages. If you notice any
unexpected version bumps, consider those versions malicious and unpublish them.
Delete Unauthorized Repositories: Look for and delete any unauthorized GitHub repositories,
especially those with Dune-themed names or matching the indicators mentioned above.
Pin Exact Versions: To prevent silent upgrades to malicious patch releases, make sure to pin
exact versions of your npm packages.
###