Malicious SAP npm packages target crypto wallet data

A supply-chain attack compromised four SAP-linked npm packages (mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, @cap-js/sqlite@2.2.2), inserting an obfuscated 11.7MB payload that steals crypto wallets, cloud credentials, SSH keys and CI/CD secrets. The packages receive roughly 572,000 downloads per week, expanding the scale and risk to developer workstations and build environments. Attackers used a Bun runtime loader and strong encryption (PBKDF2 with 200,000 SHA-256 iterations) and avoid Russian locales; researchers track the activity as “TeamPCP.” Market impact: stolen private keys and tokens could enable direct crypto theft and forced liquidations, increasing short-term sell pressure and raising security risk premiums for wallets, developer tooling and projects that rely on affected packages. Developers and teams using SAP CAP/MTA should audit lockfiles, rotate credentials and inspect CI/CD logs; at least one compromised version (@cap-js/sqlite@2.2.2) was unpublished from npm.