CRITICAL9.6npmGHSA-jpvj-wpmj-h7rvSupply chain compromise via malicious @cap-js/openapiModified: 9/10/2026