Supply chain compromise in cap-js/cds-dbs npm packages (CVE-2026-46421)

CVE-2026-46421 is a supply chain compromise in which malicious versions of `@cap-js/sqlite`, `@cap-js/postgres`, and `@cap-js/db-service` were published on April 29, 2026. The malicious packages harvested credentials from affected machines and attempted self-propagation. Any installation of a compromised version should be treated as a full credential compromise, requiring rotation of npm tokens, cloud provider credentials, SSH keys, and GitHub PATs. Affected versions: - @cap-js/sqlite = 2.2.2 - @cap-js/postgres = 2.2.2 - @cap-js/db-service = 2.10.1 We recommend updating to: @cap-js/sqlite >= 2.4.0, @cap-js/postgres >= 2.3.0, @cap-js/db-service >= 2.11.0. CVSS 9.3 · our assessment: act_now Vendor advisory: https://github.com/cap-js/cds-dbs/security/advisories/GHSA-pvw4-cvr4-97p8 Details: https://vuln.today/cve/CVE-2026-46421