Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Vulnerability Description
DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.
CVSS Information
N/A
Vulnerability Type
内嵌的恶意代码
Vulnerability Title
DuckDB 安全漏洞
Vulnerability Description
DuckDB是DuckDB开源的一个进程内 SQL OLAP 数据库管理系统。 DuckDB存在安全漏洞，该漏洞源于npm包被植入恶意代码，可能干扰加密货币交易。以下产品和版本受到影响：DuckDB node-api 1.3.3版本、node-bindings 1.3.3版本、duckdb 1.3.3版本和duckdb-wasm 1.29.2版本。
CVSS Information
N/A
Vulnerability Type
N/A