Executive brief
A compromised version of the @cap-js/openapi software library was released, containing malicious code designed to steal sensitive information. This library is used by developers to integrate OpenAPI specifications into their applications. If installed, the malicious code can steal login tokens, cloud access keys, and security credentials from the developer's machine or build environment, potentially leading to unauthorized access to corporate systems and data.
Technical details
A supply chain compromise resulted in the publication of a malicious version of the @cap-js/openapi npm package (version 1.4.1). The package contains embedded malicious code (CWE-506) that executes upon installation or use. This malware is designed to harvest sensitive credentials from the local environment, including npm tokens, cloud provider credentials, SSH keys, and GitHub Personal Access Tokens (PATs). Additionally, the malware attempts to self-propagate. Users must upgrade to version 1.4.2 or higher and rotate all credentials that were present on any machine where the compromised version was installed.
Affected products
- SAP @cap-js/openapi 1.4.1
Timeline
- 2026-05-19: disclosed: Malicious version 1.4.1 published to npm
- 2026-05-19: patched: Version 1.4.2 released to address the compromise
- 2026-06-04: advisory: GitHub Advisory published