CVE-2025-59037
4 advisories.
npm/duckdb CVE-2025-59037: high, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade duckdb to 1.3.4 or later.
npm i duckdb@1.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.3 | 1.3.4 | - |
Fixed versions
| 1.3.4 |
Sources
- osv: GHSA-w62p-hx95-gf2c
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://nvd.nist.gov/vuln/detail/CVE-2025-59037
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON
npm/@duckdb/node-api CVE-2025-59037: high, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade @duckdb/node-api to 1.3.4-alpha.27 or later.
npm i @duckdb/node-api@1.3.4-alpha.27Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.3 | 1.3.4-alpha.27 | - |
Fixed versions
| 1.3.4-alpha.27 |
Sources
- osv: GHSA-w62p-hx95-gf2c#npm/@duckdb/node-api
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://nvd.nist.gov/vuln/detail/CVE-2025-59037
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON
npm/@duckdb/node-bindings CVE-2025-59037: high, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade @duckdb/node-bindings to 1.3.4-alpha.27 or later.
npm i @duckdb/node-bindings@1.3.4-alpha.27Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.3 | 1.3.4-alpha.27 | - |
Fixed versions
| 1.3.4-alpha.27 |
Sources
- osv: GHSA-w62p-hx95-gf2c#npm/@duckdb/node-bindings
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://nvd.nist.gov/vuln/detail/CVE-2025-59037
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON
npm/@duckdb/duckdb-wasm CVE-2025-59037: high, EPSS 0.37%
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Action: Upgrade @duckdb/duckdb-wasm to 1.30.0 or later.
npm i @duckdb/duckdb-wasm@1.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.29.2 | 1.30.0 | - |
Fixed versions
| 1.30.0 |
Sources
- osv: GHSA-w62p-hx95-gf2c#npm/@duckdb/duckdb-wasm
- https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c
- https://nvd.nist.gov/vuln/detail/CVE-2025-59037
- https://github.com/duckdb/duckdb-node
- https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
CVE-2025-59037 · published · modified · JSON