TGViewer
Programming Programming @programmingreddit · 903 subscribers
Post #13133 90
Someone compromised SAP's npm packages and used the CI pipeline against itself
https://safedep.io/mini-shai-hulud-and-sap-compromise/

https://redd.it/1sz094x
@programmingreddit
SafeDep - Real-time Open Source Software Supply Chain Security Mini Shai Hulud and SAP Compromise Four SAP npm packages published on April 29, 2026 contain a two-stage credential-stealing payload targeting GitHub tokens, AWS keys, and CI/CD pipelines. The packages share SAP-affiliated maintainers, pointing to a publisher account compromise.
Open in Telegram All posts from @programmingreddit
More from @programmingreddit
  1. Sep 29, 2026Fast Primality Testing for 32-bit integers via Forisek and Jancina https://leetarxiv.subst…
  2. Sep 29, 2026nine npm packages shipping worm that spread by itself over SSH https://safedep.io/dirtybla…
  3. Sep 28, 2026Packing Binary Is Fun, Actually https://hereticpleb.vercel.app/blog/packing-binary-is-fun-…
  4. Sep 27, 2026Don't couple your Go code to GitHub https://iain.rocks/blog/dont-couple-your-go-code-to-gi…
  5. Sep 27, 2026Postgres AT TIME ZONE 'UTC' does NOT do what you think it does https://bookofrevenue.com/b…
  6. Sep 26, 2026Optimizing a Lock-Free Ring Buffer https://david.alvarezrosa.com/posts/optimizing-a-lock-f…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →