GHSA-jpvj-wpmj-h7rv
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jpvj-wpmj-h7rv
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-jpvj-wpmj-h7rv/GHSA-jpvj-wpmj-h7rv.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jpvj-wpmj-h7rv
- Published
- 2026-06-04T19:37:04Z
- Modified
- 2026-09-10T03:51:08Z
- Severity
-
- 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Supply chain compromise via malicious @cap-js/openapi
- Details
-
Impact
On May 19, 2026, a compromised version of @cap-js/openapi@1.4.1 was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
Patches
Upgrade to @cap-js/openapi >= 1.4.2 If the compromised version was ever installed, rotate all affected credentials.
Workarounds
No workarounds.
References
- Database specific
{ "cwe_ids": [ "CWE-506" ], "github_reviewed": true, "github_reviewed_at": "2026-06-04T19:37:04Z", "nvd_published_at": null, "severity": "CRITICAL" }- References
Affected packages
npm / @cap-js/openapi
Package
- Name
- @cap-js/openapi
- View open source insights on deps.dev
- Purl
- pkg:npm/%40cap-js/openapi