npm/@duckdb/node-bindings CVE-2025-59037: high 8.6, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade @duckdb/node-bindings to 1.3.4-alpha.27 or later.
npm i @duckdb/node-bindings@1.3.4-alpha.27Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.3 | 1.3.4-alpha.27 | - |
Fixed versions
| 1.3.4-alpha.27 |
Sources
- osv: GHSA-w62p-hx95-gf2c#npm/@duckdb/node-bindings
- nvd: CVE-2025-59037
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON