Malicious code was injected into four legitimate SAP CAP npm packages used in standard SAP development workflows. The compromised versions added a Bun-based preinstall hook that harvests GitHub/npm tokens, GitHub Actions secrets, and cloud credentials (AWS, Azure, GCP, Kubernetes), then exfiltrates them via GitHub using encrypted payloads. Upgrade immediately to the clean fixed version 1.2.49.