GHSA-jpvj-wpmj-h7rv: Supply chain compromise via malicious @cap-js/openapi
Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
Published Jun 4, 2026
Affected packages
@cap-js/openapi
- Ecosystem
- npm
- Affected
- = 1.4.1
- Fixed in
- 1.4.2
- Check
npm ls @cap-js/openapi
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
Patches
Upgrade to @cap-js/openapi >= 1.4.2 If the compromised version was ever installed, rotate all affected credentials.
Workarounds
No workarounds.
References
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology