Digital Warfare Podcast Daily Brief May 04, 2026

The Digital Warfare Podcast · May 4, 2026 · 5m

Summary

Attackers weaponized four official SAP-published npm packages - mbt, @cap-js/sqlite, @cap-js/postgres, and @cap-js/db-service - with a malicious worm called Mini Shai-Hulud. The malware used a hidden preinstall script to download the Bun runtime and execute an obfuscated payload that harvested npm tokens, GitHub secrets, cloud credentials, Kubernetes service account data, SSH keys, .env contents, and AI coding tool configurations. Any system that installed the compromised versions should be treated as fully exposed, with immediate credential revocation and project-level artifact…