{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@cap-js/openapi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.1"
            },
            {
              "fixed": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.1"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T19:37:04Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nOn May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published.\nThe malicious packages harvested credentials and attempted self-propagation.\nIf a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.\n\n### Patches\n\nUpgrade to @cap-js/openapi \u003e= 1.4.2\nIf the compromised version was ever installed, rotate all affected credentials.\n\n### Workarounds\nNo workarounds.\n\n### References\n\n- [SAP Note 3747787](https://me.sap.com/notes/3747787)\n- [Developer FAQ](https://www.sap.com/documents/2026/05/8203a8b9-4d7f-0010-bca6-c68f7e60039b.html)",
  "id": "GHSA-jpvj-wpmj-h7rv",
  "modified": "2026-06-04T19:37:04Z",
  "published": "2026-06-04T19:37:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cap-js/openapi/security/advisories/GHSA-jpvj-wpmj-h7rv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cap-js/openapi"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3747787"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2026/05/8203a8b9-4d7f-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Supply chain compromise via malicious @cap-js/openapi"
}