Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-59037— DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

Quick assessment

Affected
duckdb duckdb-node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DuckDB是DuckDB开源的一个进程内 SQL OLAP 数据库管理系统。 DuckDB存在安全漏洞，该漏洞源于npm包被植入恶意代码，可能干扰加密货币交易。以下产品和版本受到影响：DuckDB node-api 1.3.3版本、node-bindings 1.3.3版本、duckdb 1.3.3版本和duckdb-wasm 1.29.2版本。

EPSS 0.37% · P29
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-59037

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Source: CVE Program / CVE List V5
Vulnerability Description
DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
内嵌的恶意代码
Source: CVE Program / CVE List V5
Vulnerability Title
DuckDB 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DuckDB是DuckDB开源的一个进程内 SQL OLAP 数据库管理系统。 DuckDB存在安全漏洞，该漏洞源于npm包被植入恶意代码，可能干扰加密货币交易。以下产品和版本受到影响：DuckDB node-api 1.3.3版本、node-bindings 1.3.3版本、duckdb 1.3.3版本和duckdb-wasm 1.29.2版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
duckdb duckdb-node = 1.3.3 -

II. Public POCs for CVE-2025-59037

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-59037

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-59037 (1)

Security Blog Posts for CVE-2025-59037 (1)

IV. Related Vulnerabilities

Same vendor: duckdb
Same weakness: CWE-506

V. Comments for CVE-2025-59037

No comments yet

Leave a comment