The worm that infects the tools developers trust to catch it- 246

April 30, 2026

TeamPCP's Mini Shai-Hulud campaign has spent the past 48 hours poisoning official npm and PyPI packages across SAP's cloud development ecosystem, Intercom's customer-messaging SDK, and the widely used Lightning deep-learning framework — infecting preinstall scripts that execute attacker code automatically, before a single line of the developer's own application ever runs.

The mechanism is worm-like by design, echoing the earlier Shai-Hulud campaign it's named after. Once a poisoned package installs, a multi-stage payload activates: it steals developer secrets — GitHub tokens, npm credentials, cloud credentials for AWS, Azure, and GCP, Kubernetes tokens, and GitHub Actions secrets, in some cases extracting them directly from CI runner memory — then encrypts everything it collected and exfiltrates the locked data into a new GitHub repository created under the victim's own account. The same code then attempts to propagate further, infecting additional repositories and package distributions in a self-sustaining chain. Wiz and Socket, the two security firms that identified the campaign, attribute it to TeamPCP, a crew already linked to earlier supply-chain compromises of Checkmarx, Bitwarden, Telnyx, LiteLLM, and Aqua Security's Trivy scanner — a track record that places this squarely within a sustained, ongoing campaign rather than an isolated incident.

The scale compounds through dependency reach rather than any single package's popularity. Four official SAP JavaScript and cloud-application packages, collectively pulling roughly 572,000 weekly downloads, were poisoned between 09:55 and 12:14 UTC on April 29; SAP's only public response was to note that a security advisory exists behind its customer login wall. The following day, the same malicious code turned up in intercom-client, the official SDK for Intercom's customer communications API, with roughly 360,000 weekly downloads and more than 100 dependent projects listed on npm — though Socket's researchers note the real exposure likely extends well past those direct dependents, since the package commonly runs inside backend services and CI/CD pipelines that most security teams wouldn't think to audit for a messaging SDK. The same day, PyPI's Lightning package — a deep learning framework downloaded hundreds of thousands of times daily — was poisoned with a near-identical obfuscated payload, confirming the campaign now spans two entirely separate open-source ecosystems using shared tooling and shared tradecraft.

What makes Mini Shai-Hulud distinct from a conventional supply-chain compromise is the specific choice of targets: SAP's cloud tooling, a customer-support SDK, and an AI development framework are not incidental victims but infrastructure that security and developer teams themselves rely on daily — meaning organizations that have already invested in supply-chain monitoring are being hit precisely through the tools they use to do that monitoring. TeamPCP's pattern across Checkmarx, Bitwarden, and now SAP suggests a deliberate strategy of targeting security and developer tooling specifically, on the logic that compromising the software supply chain's own defensive layer yields far more downstream access than attacking any single application ever could.