Malicious Package Affecting @cap-js/openapi package, versions =1.4.1
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-CAPJSOPENAPI-17751068
- published1 Jul 2026
- disclosed4 Jun 2026
- creditUnknown
Introduced: 4 Jun 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the @cap-js/openapi package.
Overview
@cap-js/openapi is a malicious package. through the installation of a compromised package version. An attacker can exfiltrate sensitive credentials and propagate malicious code by leveraging the malicious code executed during the package installation.