SAP and Intercom hit by Mini Shai-Hulud attack, targeting cloud credentials

The TeamPCP hacking group compromised software packages from SAP, Intercom, and the PyPI package Lightning. This supply chain attack, named Mini Shai-Hulud, injected malicious code into npm and PyPI packages to steal developer credentials.

The malware harvests secrets including credentials for GitHub, npm, AWS, Azure, and GCP. It exfiltrates stolen data by creating public GitHub repositories under the victims' own accounts.

Security researchers report the malware self-propagates by using stolen tokens to infect additional software packages. This follows a trend of worm-like attacks targeting the software ecosystem.