The npm package @cap-js/sqlite version 2.2.2 was compromised by a threat actor impersonating SAP toolchain maintainers. The malicious package includes hidden files (setup.mjs and execution.js) that evade manifest allowlist checks and execute during installation. The large execution.js file likely contains a payload or exfiltration binary. This package is used in SAP CAP applications, often in local development and CI environments where sensitive credentials may be accessible. Systems with this package installed should be considered fully compromised.