A supply-chain compromise has emerged, specifically targeting the SAP developer ecosystem via manipulated npm packages. The attack leverages a new preinstall hook in a trusted package, which leads to the execution of a setup.mjs file that downloads and utilizes the Bun JavaScript runtime. The core of the threat lies within an obfuscated payload named execution.js, approximately 11.7 MB in size, functioning as a credential stealer and framework for propagating the attack.