Description
The DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions. The following packages and versions are affected:
@duckdb/[email protected]@duckdb/[email protected][email protected]@duckdb/[email protected]
Note: The current release version of DuckDB is 1.3.
Recommendation
Update the @duckdb/duckdb-wasm package to the latest compatible version. Followings are version details:
- Affected version(s): = 1.29.2
- Patched version(s): 1.30.0
References
Could your website be exposed too?
SmartScanner can check your website for DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prebid-universal-creative latest on npm briefly compromised - CVE-2025-59039
- Prebid.js NPM package briefly compromised - CVE-2025-59038
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-devtools - CVE-2026-45321
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-vite-plugin - CVE-2026-45321
You might also like:
See something that needs correcting? Let us knowUpdated September 10, 2025