TeamPCP SAP CAP Attack

What it is

A suspected supply-chain compromise of npm packages tied to SAP's Cloud Application Programming Model (CAP) and cloud deployment tooling, attributed to a TeamPCP-linked actor. Affected packages: mbt (the Cloud MTA Build Tool), @cap-js/sqlite (SAP CAP's SQLite service package, not the generic SQLite library), @cap-js/postgres, and @cap-js/db-service. Suspicious versions were published in a short window on April 29, 2026; @cap-js/sqlite@2.2.2 has already been unpublished.

How it works

Each tarball keeps the real SAP source (files carry npm's standard Oct 26 1985 timestamp) but injects three files timestamped 15:25–17:43 UTC on Apr 29, 2026 — a modified package.json, setup.mjs, and execution.js — indicating tarballs were post-processed from a legitimate source. The package.json adds "preinstall": "node setup.mjs", firing on every npm install. The loader setup.mjs is byte-identical across all four packages (MD5: 35baf8316645372eea40b91d48acb067). It probes ldd --version and /etc/os-release for glibc vs. musl, downloads Bun (bun-v1.3.13) from GitHub Releases (skipped if Bun is already on PATH), chmod 755, runs execution.js via execFileSync, then deletes the temp Bun dir in a finally block. It follows HTTP redirects without validating the destination and uses PowerShell -ExecutionPolicy Bypass on Windows. Execution inherits whatever privileges ran the install.

Preconditions / Affected

Any developer or CI/CD environment that installed an affected version during the exposure window. Runs at install time before application code, so a build agent or dev machine pulling the package is enough.

What to do

• Review dependency trees and lockfiles for the affected versions; verify whether they were installed during the exposure window.
• Do not install the affected versions.
• Rotate any credentials or tokens exposed in build or developer environments.
• Review CI/CD logs for unexpected network activity or binary execution.
• Hunt for the loader by MD5 (above), for a preinstall invoking node setup.mjs, or for Bun downloads from github.com/oven-sh/bun/releases originating from an install.

Caveats

Socket labels this a developing, "suspected" attack with technical details still emerging. npm download counts can lag or aggregate, so per-package figures (@cap-js/db-service ~260k, @cap-js/sqlite ~250k, mbt ~52k, @cap-js/postgres ~10k weekly) may be inexact.

The execution.js payload (~11.7 MB) is obfuscated with javascript-obfuscator plus a __decodeScrambled() layer — PBKDF2, 200,000 SHA-256 iterations, salt ctf-scramble-v2, Fisher-Yates keystream shuffle, XOR — whose function name, algorithm, salt, and iteration count match Checkmarx and Bitwarden payloads, but its actual objective was not yet decoded at publication.