A large-scale supply chain attack dubbed “Mini Shai-Hulud” has compromised widely used developer packages across multiple ecosystems, impacting over 1,800 developers and exposing sensitive credentials. The campaign targeted platforms including SAP-related npm packages, the Lightning Python library, and Intercom integrations, highlighting growing risks in open-source software dependencies.
The attack, attributed to the TeamPCP hacking group, was first detected on April 29, when malicious versions of SAP npm packages were found distributing credential-stealing malware. The campaign quickly expanded to other ecosystems, including PyPI and PHP repositories, by infecting packages such as Lightning and intercom-client, both of which have millions of monthly downloads.
At its core, the malware is designed to extract sensitive information from developer environments, including credentials, API keys, tokens, and private keys. Stolen data is then exfiltrated and published to publicly accessible GitHub repositories marked with the phrase “A Mini Shai-Hulud has Appeared,” enabling attackers to aggregate and reuse compromised access at scale.
Security researchers observed that the attack leverages supply chain propagation techniques, allowing it to spread through dependencies and infect additional packages and systems. In some cases, the malware actively scans for cloud environments, Kubernetes configurations, and secrets stored in tools like HashiCorp Vault, significantly increasing its potential impact on enterprise infrastructure.
The compromised packages include specific versions such as Lightning 2.6.2 and 2.6.3, and intercom-client versions 7.0.4 and 7.0.5, which were embedded with malicious code. The attack also extended to PHP ecosystems via intercom-php, further widening its reach.
This campaign is considered an evolution of earlier Shai-Hulud attacks observed in 2025, but with enhanced automation and broader distribution across ecosystems. Experts warn that such incidents highlight the increasing sophistication of supply chain attacks, where trusted open-source components are weaponized to infiltrate developer environments and enterprise systems at scale.
The incident underscores the urgent need for stronger dependency management, real-time monitoring, and credential protection strategies, as attackers continue to exploit the trust and interconnected nature of modern software development pipelines.
