SAP Ecosystem Hit by Mini Shai-Hulud Supply-Chain Attack Exploiting Claude Code Hooks
SAP’s NPM packages sit within the enterprise software development supply chain, meaning malware inserted into the publishing process or dependencies could spread through the installation chain into development environments. The Mini Shai-Hulud attack involved hacker group TeamPCP, which sought to steal cloud account credentials and development credentials while using trusted packages to conceal the intrusion.
Cybersecurity companies recently disclosed that TeamPCP planted malicious scripts in NPM packages within the SAP ecosystem and abused Anthropic’s Claude Code hooks to automatically commit malicious content to victims’ code repositories. As of July 20, 2026, reports had not disclosed the number of affected organizations, financial losses, the exact discovery date or the versions of the affected packages.
All Coverage
1 original reportsThe Backstory
The history behind this event‘Mini Shai-Hulud’ Supply-Chain Attack Targets AntV Ecosystem and Claude Code
“Mini Shai-Hulud” is a supply-chain attack targeting the distribution pipeline for open-source packages. The TeamPCP hacking group compromised Alibaba-owned data visualization library AntV to spread malware into developer environments. With the affected ecosystem recording 1.5 million downloads a week, the threat can propagate through project dependencies and expose cloud accounts, cryptocurrency assets and corporate source code.
The latest investigation found that TeamPCP had published more than 600 malicious packages designed to steal cloud-service credentials and cryptocurrency wallet data. The packages specifically target Anthropic’s Claude Code and Microsoft Visual Studio Code for backdoor installation. Reports have not disclosed the exact date the attack was first detected, the number of victims or the amount of losses. The key measure of its scale currently available is 1.5 million weekly downloads.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →