MAL-2025-46992

    Dashboard / Malicious Package / MAL-2025-46992

    MAL-2025-46992

    Published: 9 Sept 2025Last Modified: 9 Sept 2025

    Summary: Malicious code in @duckdb/node-api (npm)

    Details: The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and resetting 2FA. The attacker then used stolen credentials to publish malicious versions of DuckDB packages. The malicious code was designed to interfere with cryptocurrency transactions, potentially allowing the attacker to steal or manipulate crypto wallet addresses and transactions. This represents a supply chain attack where legitimate packages were compromised to distribute malware. The attack was discovered within 4 hours and the affected versions were immediately deprecated and deleted from npm. The maintainers re-released safe versions (1.3.4) to ensure users get clean packages.

    References: https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c

    Affected packages

    Package

    Name: @duckdb/node-api

    Purl: pkg:npm/%40duckdb/node-api

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.3.3