A Mini Shai-Hulud Has Appeared: Obfuscated Bun Runtime Payloads Hit SAP-Related npm Packages

StepSecurity discovered a new npm supply chain attack campaign called Shai-Hulud that uses preinstall hooks to download the Bun JavaScript runtime and execute an 11 MB obfuscated payload. The attack specifically targets SAP-related npm packages in the ecosystem. At least two SAP-ecosystem packages have been confirmed as compromised so far. The campaign uses obfuscated payloads and represents an active supply chain threat to organizations using affected npm packages. This attack demonstrates sophisticated techniques by leveraging the Bun runtime environment to execute malicious code.