If you have SAP in your environment and then get ransomed, it's going to be a tough call to determine which threat to mitigate first. https://www.bleepingcomputer.com/news/security/official-sap-npm-packages-compromised-to-steal-credentials/