SAP NPM Supply Chain Compromise – Malicious Packages Stealing Developer Credentials

Scope: SAP NPM Packages / Developer Environments

Severity: Red

A supply chain attack targeting official SAP NPM packages allowed threat actors to inject credential-harvesting code that exfiltrates API keys, tokens, and environment variables to attacker-controlled infrastructure upon installation or update. Exploitation can propagate through CI/CD pipelines into enterprise systems and cloud services, enabling lateral movement and poisoning of downstream software releases. Organizations should remove compromised packages, rotate all credentials immediately, and enforce dependency integrity verification and package version pinning.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.