CVE-2026-46421 Overview
CVE-2026-46421 is a supply chain compromise affecting npm packages in the SAP Cloud Application Programming Model (CAP) ecosystem. On April 29, 2026, attackers published malicious versions of @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, and @cap-js/db-service@2.10.1 to the npm registry. The compromised packages harvest credentials from installation hosts and attempt self-propagation to additional packages. Any machine that installed a compromised version must treat npm tokens, cloud provider credentials, SSH keys, and GitHub Personal Access Tokens (PATs) as exposed. The vulnerability is tracked under [CWE-506: Embedded Malicious Code].
Critical Impact
Compromised @cap-js package versions exfiltrate developer and CI/CD credentials, enabling downstream account takeover and further supply chain propagation.
Affected Products
- @cap-js/sqlite version 2.2.2
- @cap-js/postgres version 2.2.2
- @cap-js/db-service version 2.10.1
Discovery Timeline
- April 29, 2026 - Compromised package versions published to npm
- 2026-07-15 - CVE-2026-46421 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-46421
Vulnerability Analysis
The cap-js/cds-dbs monorepo provides SQL database services for the SAP Cloud Application Programming Model. Attackers gained the ability to publish trojanized versions of three packages in this monorepo to the npm registry. When developers or automated build systems installed the affected versions, the embedded malicious code executed during the package lifecycle and began scanning the host for credential material.
The malicious code targets high-value secrets: npm authentication tokens, cloud provider credentials for AWS, Azure, and GCP, SSH private keys, and GitHub PATs. Once harvested, credentials are exfiltrated to attacker-controlled infrastructure. The payload also attempts self-propagation by using captured npm publish tokens to trojanize additional packages owned by the compromised accounts. This pattern mirrors the "Shai-Hulud" style worming supply chain attacks documented by the community.
Root Cause
The root cause is the publication of malicious code to a trusted namespace on the npm registry, not a defect in the CAP source repository itself. Consumers implicitly trust versioned artifacts pulled from npm, and the attackers abused that trust boundary to deliver embedded malicious code to downstream installations.
Attack Vector
The attack requires no user interaction beyond a standard npm install of a project that declares dependencies on the affected packages or version ranges. Continuous integration systems, developer workstations, and container build pipelines are all viable execution contexts. Because the payload runs with the privileges of the installing user or service account, it can access any secret material reachable from that identity.
No verified exploit code is publicly available. See the GitHub Security Advisory and the Step Security analysis for detailed indicators.
Detection Methods for CVE-2026-46421
Indicators of Compromise
- Presence of @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, or @cap-js/db-service@2.10.1 in package-lock.json, yarn.lock, pnpm-lock.yaml, or installed node_modules directories.
- Outbound network connections from node processes during npm install to previously unseen domains or IP addresses.
- Unexpected reads of ~/.npmrc, ~/.aws/credentials, ~/.ssh/, or environment variables containing tokens by post-install scripts.
- New unauthorized npm package publications from developer or CI service accounts after April 29, 2026.
Detection Strategies
- Inventory all Node.js projects and CI pipelines for the specific compromised package versions using software composition analysis tools.
- Monitor endpoint and CI runner telemetry for child processes spawned by npm, yarn, or pnpm that access credential files or make outbound network requests.
- Correlate npm audit logs and GitHub audit logs for anomalous token usage originating after April 29, 2026.
Monitoring Recommendations
- Enable secret scanning and anomaly detection on source code hosting platforms for exposed npm tokens and PATs.
- Alert on new npm package versions published from service identities outside normal release windows.
- Continuously monitor cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) for API calls originating from unfamiliar IPs after suspected exposure.
How to Mitigate CVE-2026-46421
Immediate Actions Required
- Upgrade to @cap-js/sqlite >= 2.4.0, @cap-js/postgres >= 2.3.0, and @cap-js/db-service >= 2.11.0 across all projects and lockfiles.
- If a compromised version was ever installed, rotate all credentials accessible from that machine: npm tokens, cloud provider keys, SSH keys, and GitHub PATs.
- Revoke and reissue any tokens that may have been present in CI/CD environments during the exposure window.
- Rebuild affected developer workstations and CI runners from known-good images.
Patch Information
Maintainers published clean releases with the malicious code removed. Consult the GitHub Security Advisory GHSA-pvw4-cvr4-97p8 and SAP Security Note #3747787 for the authoritative fixed versions and vendor guidance.
Workarounds
- No workarounds are available per the vendor advisory. Upgrading and rotating credentials is required.
- Pin dependencies to known-good versions and enable lockfile integrity verification to prevent reintroduction of compromised artifacts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
