CVE-2026-46421
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
On April 29, 2026, malicious versions of npm packages `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. These packages harvested credentials and attempted self-propagation within the victim's environment.
Risk Assessment
Installing any of these versions exposes all credentials on the machine, including npm tokens, SSH keys, GitHub PATs, and cloud provider credentials. Attackers can gain full access to organizational resources and accounts.
Recommendation
Immediately upgrade to safe versions: `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If any compromised version was ever installed, rotate all credentials on the affected machine.
Original NVD description (English source)
The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. User should upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials. No known workarounds are available.