The npm package @cap-js/db-service, a core database service layer for SAP CAP applications, was compromised by a threat actor impersonating SAP maintainers. Malicious code was embedded in the package via a manifest evasion technique that hid a setup script (setup.mjs) from allowlist inspection while still executing it during installation. An anomalously large execution.js file likely contains a payload or exfiltration binary. This compromise affects version 2.10.1 and poses a severe risk to any system with this package installed.