TeamPCP compromised multiple npm packages used in SAP's cloud application development environment. The attack group deployed malware dubbed "Mini Shai-Hulud" across the affected packages, expanding their supply chain targeting beyond previous campaigns. Defenders should audit npm dependencies tied to SAP development workflows immediately. The compromised packages introduce code execution risk into build pipelines and deployed applications. TeamPCP's shift toward SAP infrastructure reflects a deliberate strategy to infiltrate enterprise cloud ecosystems through developer tooling. Organizations running SAP cloud applications must review package manifests, verify integrity of installed versions, and implement stricter dependency pinning controls. npm security advisories should publish full package names and affected version ranges for rapid identification. Teams should treat this as a supply chain incident requiring both immediate patching and longer-term dependency verification practices.