T1195.001Compromise Software Dependencies and Development Tools
99%
“dev / blog / sap - cap - npm - packages - supply - chain - attack and stepsecurity, https : / / www. stepsecurity. io / blog / a - mini - shai - hulud - has - appeared and bleepingcomputer, https : / / www. bleepingcomputer. com / news / security / official - sap - npm - packages…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
99%
“https : / / www. cisa. gov / news - events / alerts / 2026 / 04 / 28 / cisa - adds - two - known - exploited - vulnerabilities - catalog. - 2026 - 04 - 29 : four official sap npm packages were poisoned between approximately 09 : 55 and 12 : 14 utc : mbt 1. 2. 48, @ cap - js / db …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
98%
“io / blog / mini - shai - hulud - supply - chain - sap - npm - socket ( sap cap analysis ) : https : / / socket. dev / blog / sap - cap - npm - packages - supply - chain - attack - socket ( packagist intercom - php ) : https : / / socket. dev / blog / mini - shai - hulud - packag…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
96%
“cd secrets, and environment variables. the malware uniquely weaponizes. claude / settings. json and. vscode / tasks. json for ai coding agent persistence, which wiz characterizes as the first observed supply chain attack to target ai coding agent configurations. command and contr…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
95%
“completeness ) : https : / / isc. sans. edu / diary / 32926 - cert - eu, fbi / ic3, bsi germany, singapore csa, ncsc uk, acsc australia, enisa : searched, no new w18 teampcp - specific advisory identified beyond the prior march advisories of record tier 4 ( social and dark web si…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
94%
“, pypi, and packagist within a single 36 hour operational window. source : socket, https : / / socket. dev / blog / mini - shai - hulud - packagist - malicious - intercom - php - package - compromise. - 2026 - 04 - 30 : dark reading published " teampcp hits sap packages with mini…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1485Data Destruction
93%
“document stores ) is permanently destroyed even if the ransom is paid. the report ships six sha - 256 hashes for vect windows, linux, and esxi variants, and confirms the prior vect - teampcp partnership announcement on breachforums targeting the trivy, litellm, telnyx, checkmarx,…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
89%
“. themes and trends - mini shai - hulud realized the cross - ecosystem worm risk in production. the w17 weekly ' s third watch item flagged that canistersprawl carried pypi - jump logic without observed execution. in w18 a separate but ttp - aligned worm ( mini shai - hulud ) exe…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
76%
“##agist ), realizing the theoretical canistersprawl - style ecosystem - jump risk flagged in the w17 weekly. separately, check point research disclosed on april 27 to 28 that teampcp ' s extortion partner vect ships a chacha20 - ietf nonce - reuse flaw that effectively turns vect…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1588.006Vulnerabilities
65%
“/ - aviatrix threat research center ( sap npm coverage ) : https : / / aviatrix. ai / threat - research - center / official - sap - npm - packages - compromised - to - steal - credentials - 2026 / - mandiant / google threat intelligence : searched, no w18 teampcp publication iden…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
63%
“document stores ) is permanently destroyed even if the ransom is paid. the report ships six sha - 256 hashes for vect windows, linux, and esxi variants, and confirms the prior vect - teampcp partnership announcement on breachforums targeting the trivy, litellm, telnyx, checkmarx,…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195Supply Chain Compromise
61%
“ai coding agents. reporting suggests this is the first documented supply chain attack to target ai agent configuration as an execution vector, which has direct implications for any organization whose developers run claude code, cursor, continue, cline, or similar tools with proje…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1587Develop Capabilities
56%
“cd secrets, and environment variables. the malware uniquely weaponizes. claude / settings. json and. vscode / tasks. json for ai coding agent persistence, which wiz characterizes as the first observed supply chain attack to target ai coding agent configurations. command and contr…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1485Data Destruction
54%
“##agist ), realizing the theoretical canistersprawl - style ecosystem - jump risk flagged in the w17 weekly. separately, check point research disclosed on april 27 to 28 that teampcp ' s extortion partner vect ships a chacha20 - ietf nonce - reuse flaw that effectively turns vect…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1587Develop Capabilities
51%
“dev / blog / sap - cap - npm - packages - supply - chain - attack and stepsecurity, https : / / www. stepsecurity. io / blog / a - mini - shai - hulud - has - appeared and bleepingcomputer, https : / / www. bleepingcomputer. com / news / security / official - sap - npm - packages…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
44%
“- credentials / - bleepingcomputer ( vect wiper bug ) : https : / / www. bleepingcomputer. com / news / security / broken - vect - 20 - ransomware - acts - as - a - data - wiper - for - large - files / - securityweek ( sap npm ) : https : / / www. securityweek. com / sap - npm - …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1587Develop Capabilities
43%
“io / blog / mini - shai - hulud - supply - chain - sap - npm - socket ( sap cap analysis ) : https : / / socket. dev / blog / sap - cap - npm - packages - supply - chain - attack - socket ( packagist intercom - php ) : https : / / socket. dev / blog / mini - shai - hulud - packag…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
41%
“published april 30 ; intercom - client ' s compromise is documented by ox as a downstream effect of its lightning dependency being infected during a local install, demonstrating live worm propagation through ordinary developer activity. source : ox security, https : / / www. ox. …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.002Compromise Software Supply Chain
40%
“guidance dropped on may 1 and addresses supply - chain risk for ai agents categorically but is conspicuously silent on the teampcp campaign that demonstrated ai - agent - config weaponization 48 hours earlier. analysts assess the gap between the operational tempo of the campaign …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
37%
“ai coding agents. reporting suggests this is the first documented supply chain attack to target ai agent configuration as an execution vector, which has direct implications for any organization whose developers run claude code, cursor, continue, cline, or similar tools with proje…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.002Compromise Software Supply Chain
35%
“https : / / www. cisa. gov / news - events / alerts / 2026 / 04 / 28 / cisa - adds - two - known - exploited - vulnerabilities - catalog. - 2026 - 04 - 29 : four official sap npm packages were poisoned between approximately 09 : 55 and 12 : 14 utc : mbt 1. 2. 48, @ cap - js / db …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1587Develop Capabilities
32%
“https : / / www. cisa. gov / news - events / alerts / 2026 / 04 / 28 / cisa - adds - two - known - exploited - vulnerabilities - catalog. - 2026 - 04 - 29 : four official sap npm packages were poisoned between approximately 09 : 55 and 12 : 14 utc : mbt 1. 2. 48, @ cap - js / db …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.