Malicious SAP npm packages target crypto wallet data
The function name, algorithm, salt, and iteration count are the same as those in previous Checkmarx and Bitwarden payloads. This suggests that the same tools are being used in multiple campaigns. Socket is keeping an eye on the activity under the name “TeamPCP” and has made a separate tracking page for what it calls the “mini-shai-hulud” campaign. Hackers target crypto developers persistently The SAP package compromise is the most recent in a series of supply chain attacks that use package managers to steal digital asset credentials. As Cryptopolitan reported at the time, researchers found five typosquatted npm packages in March 2026 that stole private keys from Solana and Ethereum developers and sent them to a Telegram bot. Cryptopolitans coverage of the ReversingLabs findings says that the attack, which was linked to the North Korean state-sponsored group Famous Chollima, specifically went after crypto wallet credentials and system secrets. The SAP attack is different in size and direction. Instead of making fake packages with names that are similar to real ones, the attackers got into real, widely used packages that were kept under SAPs namespace. Security researchers recommend that teams that use SAP CAP or MTA-based deployment pipelines check their lockfiles right away for the affected versions. Developers who installed