{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mbt"
      },
      "versions": [
        "1.2.48"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://safedep.io"
      ],
      "name": "SafeDep",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-04-30T22:23:10.078327513Z",
        "modified_time": "2026-04-30T21:59:18Z",
        "sha256": "62b15ba37c3071554cc586ba582589ad51abba89e1be51e993afdf933a18c8b1",
        "source": "amazon-inspector",
        "versions": [
          "1.2.48"
        ]
      }
    ]
  },
  "details": "Supply chain compromise of legitimate SAP packages published by threat actor \"cloudmtabot@gmail.com\" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs (4.4 KB) and execution.js (11.1 MB) bundled in the tarball, with a preinstall hook of \"node setup.mjs\". Notably, setup.mjs is explicitly excluded from the package.json \u0027files\u0027 allowlist yet is still shipped in the tarball \u2014 a manifest evasion technique intended to hide the malicious file from allowlist inspection while still executing it on install. execution.js (11.1 MB) is anomalously large for these packages and is consistent with an embedded payload or exfiltration binary. Packages were published 2026-04-29T09:55Z.\n\nmbt (SAP Multi-Target Application Build Tool) is a high-impact CLI tool used in SAP CI/CD pipelines to compile and package MTA projects. Its privileged position in build environments makes it a valuable target for credential and token exfiltration.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (62b15ba37c3071554cc586ba582589ad51abba89e1be51e993afdf933a18c8b1)\nThe package mbt was found to contain malicious code.\n",
  "id": "MAL-2026-3179",
  "modified": "2026-04-30T22:32:11Z",
  "published": "2026-04-29T10:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://safedep.io/mini-shai-hulud-and-sap-compromise/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in mbt (npm)"
}