{"action":"Upgrade @duckdb/node-api to 1.3.4-alpha.27 or later.","affected":[{"fixed":"1.3.4-alpha.27","introduced":"1.3.3"}],"component":"@duckdb/node-api","cve_ids":["CVE-2025-59037"],"ecosystem":"npm","epss":0.00372,"exploited":false,"fixed_versions":["1.3.4-alpha.27"],"ghsa_id":"GHSA-w62p-hx95-gf2c","id":"tcs_01M5KGE41AYX5ETRN5JD7T0KY0","modified_at":"2025-09-10T21:08:58Z","published_at":"2025-09-09T14:39:14Z","references":["https://osv.dev/vulnerability/GHSA-w62p-hx95-gf2c","https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c","https://nvd.nist.gov/vuln/detail/CVE-2025-59037","https://github.com/duckdb/duckdb-node","https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4","https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-w62p-hx95-gf2c#npm/@duckdb/node-api","url":"https://osv.dev/vulnerability/GHSA-w62p-hx95-gf2c"},{"source":"nvd","source_id":"CVE-2025-59037","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59037"}],"summary":"DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"}