npm/@duckdb/duckdb-wasm CVE-2025-59037: high 8.6, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade @duckdb/duckdb-wasm to 1.30.0 or later.
npm i @duckdb/duckdb-wasm@1.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.29.2 | 1.30.0 | - |
Fixed versions
| 1.30.0 |
Sources
- osv: GHSA-w62p-hx95-gf2c#npm/@duckdb/duckdb-wasm
- nvd: CVE-2025-59037
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON