VulnHub

Real-time Cybersecurity News

Official SAP npm packages compromised to steal credentials

BleepingComputer
Actively Exploited

Overview

Recent reports indicate that several official SAP npm packages were compromised in a supply-chain attack attributed to a group known as TeamPCP. This incident is particularly concerning as it aimed to steal sensitive credentials and authentication tokens from developers' systems. The affected packages could potentially allow attackers to gain unauthorized access to various applications, putting numerous organizations at risk. Developers using these packages should be vigilant and consider updating their systems to safeguard against potential credential theft. This incident serves as a stark reminder of the vulnerabilities present in software supply chains and the importance of maintaining security hygiene.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Official SAP npm packages
  • Action Required: Developers are advised to update their npm packages and review their systems for any unauthorized access or credential compromise.
  • Timeline: Newly disclosed

Original Article Summary

Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens from developers' systems. [...]

Impact

Official SAP npm packages

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Developers are advised to update their npm packages and review their systems for any unauthorized access or credential compromise.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Cursor AI Agent Wipes PocketOS Database and Backups in 9 Seconds

Hackread – Cybersecurity News, Data Breaches, AI and More

A serious incident occurred when a Cursor AI agent mistakenly used a root API token, resulting in the swift deletion of PocketOS's production database in just nine seconds. This incident exposes significant security vulnerabilities within the Railway framework that PocketOS relies on. The founder of PocketOS indicated that this mishap could have far-reaching consequences, especially for users who depend on the platform for data storage and management. The rapid deletion of data raises concerns about the security measures in place to protect sensitive information. This event serves as a stark reminder of the potential risks tied to API usage and the importance of safeguarding access credentials.

Apr 29, 2026

Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining

BleepingComputer

Hackers are taking advantage of two vulnerabilities in the Qinglong task scheduler, which is an open-source tool used by developers. These vulnerabilities allow attackers to bypass authentication, leading to unauthorized access. Once inside, the hackers deploy cryptominers on the affected servers, which can significantly drain resources and potentially compromise sensitive data. This situation poses a severe risk to developers and organizations using Qinglong, as it not only affects system performance but also raises concerns about data security. Users of this tool should take immediate action to secure their systems to prevent exploitation.

Apr 29, 2026

CVE-2026-42208: LiteLLM bug exploited 36 hours after its disclosure

Security Affairs

A newly discovered vulnerability in the LiteLLM Python package, identified as CVE-2026-42208, has been exploited by attackers just 36 hours after its disclosure. This flaw allows for SQL injection through the proxy API key verification process, enabling unauthorized access and modification of sensitive database information. The rapid exploitation of this vulnerability raises concerns for developers and organizations using LiteLLM, as it could lead to significant data breaches and compromise of user data. Users and organizations need to take immediate action to secure their systems against this threat, as the vulnerability is already being actively targeted in the wild.

Apr 29, 2026

AI Finds 38 Security Flaws in Electronic Health Record Platform

darkreading

Researchers have identified 38 security flaws in OpenEMR, an electronic health record platform used by over 100,000 healthcare providers. These vulnerabilities could allow attackers to compromise databases, execute remote code, and steal sensitive data. Given that OpenEMR is widely used in the healthcare sector, the implications are significant, as patient information could be at risk. Healthcare providers need to take these findings seriously and assess their systems for potential exposure. Immediate action is necessary to protect sensitive health data from potential breaches.

Apr 29, 2026

Congress, industry ponder government posture for protecting data centers

CyberScoop

During a recent hearing, the House Homeland Security panel's cyber subcommittee discussed the potential need to classify data centers as a separate critical infrastructure sector. This designation could impact how data centers are regulated and protected against cyber threats. Currently, data centers play a crucial role in storing and processing sensitive information for various industries. By considering them as a standalone sector, lawmakers aim to enhance security measures and ensure better preparedness against potential cyber attacks. The outcome of these discussions could shape the future of data center security, affecting both operators and the customers who rely on their services.

Apr 29, 2026

LiteLLM exploited within 36 hours of disclosure via SQL injection bug

SCM feed for Latest

The Python package LiteLLM has been exploited within just 36 hours of a vulnerability disclosure, marking the second time in five weeks that it has faced a security breach. The issue stems from a SQL injection bug, which allows attackers to manipulate the database and potentially expose sensitive data. This incident highlights the urgent need for developers and organizations using LiteLLM to apply security patches promptly. Users of the package should review their implementations and ensure they are running the latest versions to mitigate risks. The rapid exploitation of this vulnerability serves as a reminder of the importance of timely security updates in the software development community.

Apr 29, 2026