npm/duckdb CVE-2025-59037: high 8.6, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade duckdb to 1.3.4 or later.
npm i duckdb@1.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.3 | 1.3.4 | - |
Fixed versions
| 1.3.4 |
Sources
- osv: GHSA-w62p-hx95-gf2c
- nvd: CVE-2025-59037
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON