On April 29, 2026, someone hijacked four widely used SAP packages on the npm registry, slipped credential-stealing malware ...