GHSA-pvw4-cvr4-97p8
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @cap-js/sqlite | >= 2.2.2, < 2.3.0 | 2.3.0 |
| npm | @cap-js/postgres | >= 2.2.2, < 2.3.0 | 2.3.0 |
| npm | @cap-js/db-service | >= 2.10.1, < 2.11.0 | 2.11.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact
On April 29, 2026, compromised versions of `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published.
The malicious packages harvested credentials and attempted self-propagation.
If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
## Patches
Upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0.
If a compromised version was ever installed, rotate all affected credentials.
## Workarounds
No workarounds.
References
External links from the advisory. They lead to third-party sites.