CVE-2025-59037: DuckDB NPM Packages Compromised with Malware Affecting Node.js Applications
Summary
CVE-2025-59037: DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware. Affects duckdb versions >= 1.3.3, < 1.3.4. Fixed in 1.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DuckDB is an open-source database management system designed for analytical workloads. It provides a simple and efficient way to perform data analysis directly within Node.js applications. The vulnerability in question arose when malicious versions of DuckDB packages were published on npm, compromising the integrity of the software and potentially affecting users' applications.
Vulnerability Detail
The vulnerability originated from a phishing attack that led to the compromise of the DuckDB maintainers' npm account. An attacker published malicious versions of four DuckDB packages, which included code designed to interfere with cryptocoin transactions. The affected versions are '@duckdb/node-api@1.3.3', '@duckdb/node-bindings@1.3.3', 'duckdb@1.3.3', and '@duckdb/duckdb-wasm@1.29.2'. Users who inadvertently updated to these versions could face severe security risks, including unauthorized access to sensitive information and financial loss.
How To Fix
Latest published version: 1.4.4 as of 23 Oct 2026
npm install duckdb@1.4.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.4
This is the first release that contains the fix.
npm install duckdb@1.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users should avoid updating to versions 1.3.3 and 1.29.2 of the affected DuckDB packages until they can confirm they are using the patched versions. Additionally, users can monitor their package dependencies using tools like Vulert, which can alert them to open-source vulnerabilities in real-time.
Conclusion
The DuckDB NPM packages were compromised due to a phishing attack, leading to the publication of malicious versions that could interfere with cryptocoin transactions. Users are urged to update to the patched versions to secure their applications and avoid potential risks.
See every vulnerability recorded for duckdb →
FAQ
CVE-2025-59037 refers to a vulnerability in DuckDB NPM packages that were compromised with malware, affecting Node.js applications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have updated to the compromised versions, you should immediately revert to the patched versions as outlined in the 'how to fix' section.
The risks include unauthorized access to sensitive data, potential financial loss due to interference with cryptocoin transactions, and overall compromise of application integrity.
The vulnerability occurred due to a phishing attack that compromised the npm account of DuckDB maintainers, allowing the attacker to publish malicious package versions.
Related vulnerabilities
Recent vulnerabilities recorded for duckdb.
