StepSecurity discovered a new npm supply chain attack campaign called Shai-Hulud that uses preinstall hooks to download the Bun JavaScript runtime and execute an 11 MB obfuscated payload. The attack targets SAP-ecosystem packages, with at least two confirmed compromised packages identified so far. The campaign demonstrates sophisticated supply chain attack techniques by leveraging legitimate JavaScript runtime environments to deliver malicious payloads. The obfuscated nature of the payload and its large size suggest a complex attack framework. This represents an active threat to organizations using SAP-related npm packages in their development environments.