Notifications
Clear all
Topic starter
02/08/2026 11:36 am
TL;DR: A coordinated npm supply chain attack against SAP development packages used preinstall hooks and obfuscated payloads to steal developer and CI secrets, with indicators including a distinctive GitHub repository description and encrypted result files, according to Semgrep and StepSecurity. The incident shows that build dependencies can become secret-exfiltration paths, so identity teams must treat developer tooling as a governed access surface, not just software plumbing.
NHIMG editorial — based on content published by Semgrep covering the Mini Shai-Hulud npm supply chain attack targeting SAP development packages
Questions worth separating out
Q: How should teams respond when a malicious npm package can steal build secrets?
A: Treat the package as a credential exposure event, not just a dependency incident.
Q: Why do supply chain attacks on developer tools create such large identity risk?
A: Developer tools often run with trusted access to cloud, source control, and orchestration systems, so compromise turns one execution context into a multi-system identity event.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Treat install-time scripts as a governed execution path Disable or restrict preinstall and similar package hooks in high-risk pipelines, especially where build agents can reach production secrets, cloud consoles, or deployment automation.
- Rotate every credential class exposed to build environments If affected packages were installed, rotate GitHub tokens, npm tokens, GitHub Actions secrets, AWS secrets, Azure Key Vault secrets, GCP Secret Manager values, Kubernetes tokens, and any local developer tooling credentials that may have been present.
- Monitor repository activity for supply chain indicators Search for repositories with the description A Mini Shai-Hulud has Appeared, commits containing OhNoWhatsGoingOnWithGitHub, unexpected .claude/ or .vscode/setup.mjs files, and result files under results/results-*.json.
What's in the full analysis
Semgrep's full blog post covers the operational detail this post intentionally leaves for the source:
- Package version checks and advisory matching for the affected SAP development dependencies
- Repository and commit indicators of compromise that help confirm whether exfiltration occurred
- Broader remediation guidance for rotating exposed secrets across GitHub, cloud, and Kubernetes environments
- Specific scan and dependency filter actions for Semgrep customers who need to validate exposure
👉 Read Semgrep's analysis of the Mini Shai-Hulud npm supply chain attack →
Mini Shai-Hulud in SAP workflows: what does it mean for secrets risk?
Explore further
02/08/2026 12:50 pm
Mini Shai-Hulud is not just package malware, it is identity theft through build trust. The campaign shows that software installation paths can function as credential collection channels when packages are allowed to execute code during install. For identity governance, the important boundary is not the repository alone but every identity that the build process can touch. Practitioners should treat install-time execution as an identity exposure surface, not a development convenience.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What should organisations do first after detecting suspicious package installation behaviour?
A: Preserve evidence, stop the affected build paths, and inventory which identities and secret stores were reachable from those systems. Then look for repository markers, unexpected script files, and commit patterns that indicate the attacker already exfiltrated data before containment.
👉 Read our full editorial: Mini Shai-Hulud supply chain attack exposes SAP secrets
