Security Digest · Critical advisory (no CVE assigned)
GHSA-jpvj-wpmj-h7rv: Supply chain compromise via malicious @cap-js/openapi
Impact On May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published.
CVSS 9.6 Critical GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | @cap-js/openapi | = 1.4.1 | 1.4.2 |
Details
Impact
On May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
Patches
Upgrade to @cap-js/openapi >= 1.4.2 If the compromised version was ever installed, rotate all affected credentials.
Workarounds No workarounds.
References
- SAP Note 3747787 - Developer FAQ
CVSS: 9.6 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-jpvj-wpmj-h7rv github.com
- github.com github.com
- me.sap.com me.sap.com
- sap.com sap.com