Multiple SAP npm packages were compromised in a supply chain attack designed to steal developer credentials and tokens.