A Mini Shai-Hulud Targeting the SAP Ecosystem

Aikido researchers discovered a self-replicating supply chain attack targeting SAP's Node.js npm packages. The malware harvests GitHub personal access tokens (ghp_) from CI environment variables, exfiltrates encrypted secrets to attacker-controlled GitHub accounts, and uses stolen tokens to create new public repositories — enabling self-propagation. GitGuardian identified 7 exposed tokens, 23 compromised GitHub accounts, and 971 public repositories created as exfiltration infrastructure, all named with Dune-themed keywords. The attack was still active and growing at time of publication.