{"action":"Upgrade duckdb to 1.3.4 or later.","affected":[{"fixed":"1.3.4","introduced":"1.3.3"}],"component":"duckdb","cve_ids":["CVE-2025-59037"],"ecosystem":"npm","epss":0.00372,"exploited":false,"fixed_versions":["1.3.4"],"ghsa_id":"GHSA-w62p-hx95-gf2c","id":"tcs_01M5KGE3SMS4HZ2J28RER3B29N","modified_at":"2025-09-10T21:08:58Z","published_at":"2025-09-09T14:39:14Z","references":["https://osv.dev/vulnerability/GHSA-w62p-hx95-gf2c","https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c","https://nvd.nist.gov/vuln/detail/CVE-2025-59037","https://github.com/duckdb/duckdb-node","https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4","https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-w62p-hx95-gf2c","url":"https://osv.dev/vulnerability/GHSA-w62p-hx95-gf2c"},{"source":"nvd","source_id":"CVE-2025-59037","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59037"}],"summary":"DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"}