duckdb

ChainCatcher news, DuckDB's official Twitter account stated that the DuckDB Node.js and Wasm packages were compromised with malware in a recent npm supply chain attack. The official team has investigated and deprecated the affected versions, while releasing new versions. DuckDB stated that, according to npm data, no users have downloaded the affected packages. The team has released a security announcement detailing the post-analysis and response measures.

ChainCatcher message, Slow Mist Technology's Chief Information Security Officer 23 pds posted on X platform that the DuckDB NPM account was compromised, and malicious versions such as duckdb, duckdb-wasm, etc. were released. These malware are consistent with wallet-stealing malware seen in supply chain attacks. Please be aware of risk prevention.