1vulnerability
- Critical1 (100.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
cap-js-openapi
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting cap-js-openapi, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-jpvj-wpmj-h7rv | Critical | Supply chain compromise via malicious @cap-js/openapi### Impact On May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. ### Patches Upgrade to @cap-js/openapi >= 1.4.2 If the compromised version was ever installed, rotate all affected credentials. ### Workarounds No workarounds. ### References - [SAP Note 3747787](https://me.sap.com/notes/3747787) - [Developer FAQ |
| GitHub (opens in a new tab) |
- GHSA-jpvj-wpmj-h7rvCriticalSupply chain compromise via malicious @cap-js/openapi
>= 1.4.1, < 1.4.2
### Impact On May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. ### Patches Upgrade to @cap-js/openapi >= 1.4.2 If the compromised version was ever installed, rotate all affected credentials. ### Workarounds No workarounds. ### References - [SAP Note 3747787](https://me.sap.com/notes/3747787) - [Developer FAQ