The npm package @cap-js/postgres version 2.2.2 was compromised via supply chain attack by a threat actor impersonating SAP maintainers. Malicious files setup.mjs and execution.js were included in the package tarball with a preinstall hook executing setup.mjs. The setup.mjs file was hidden from package.json allowlist inspection, indicating deliberate evasion. The large execution.js file likely contains a payload or exfiltration binary. This package is used as a PostgreSQL adapter in SAP's Cloud Application Programming model, and its compromise risks exposure of database credentials and build environment secrets.