SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack

A cluster of high-impact incidents and active campaigns reported by The Hacker News (late April 2026): multiple npm supply-chain compromises (including SAP-related packages) distributing credential-stealing malware and AI-inserted malicious dependencies; a DPRK-linked campaign leveraging AI/LLM tooling, fake companies and RATs; rapid in-the-wild exploitation of newly disclosed vulnerabilities (notably LiteLLM SQLi exploited within 36 hours and a GitHub RCE exploitable via a single git push); critical unauthenticated RCE in Hugging Face LeRobot; active exploitation of a Windows Shell spoofing/​