The vulnerabilities of the node-api, node-bindings, and duckdb-wasm packages of the DuckDB relational database management system allow attackers to gain unauthorized access to protected information.

The vulnerability of the node-api, node-bindings, and duckdb-wasm packages in the DuckDB database management system is related to the presence of undeclared capabilities. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

EUVD-2021-1097

Malware in sbrugna...

EUVD-2019-0276

Malware in sbrugna...

Malicious code in nodeapi-json (npm)

The package nodeapi-json was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adf38cc7ff9fedd8e0e5018c03c9141360823a8c5143181264185160ee040728 Any computer that has this package installed or running should be considered fully...

Embedded Malicious Code

Overview @duckdb/node-api is an API for using DuckDB in Node. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code...

CVE-2025-59037

CVE-2025-59037 covers DuckDB npm packages where four Node.js packages were briefly compromised with malware: @duckdb/[email protected], @duckdb/[email protected], [email protected], and @duckdb/[email protected]. The malicious versions attempted to interfere with cryptocurrency transactions. DuckDB de...

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

The DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions. The following packages and versions are affected: -...

Malicious code in @duckdb/node-api (npm)

The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

MAL-2025-46992 Malicious code in @duckdb/node-api (npm)

The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

DuckDB 安全漏洞

DuckDB is an in-process SQL OLAP database management system from DuckDB open source. A security vulnerability exists in DuckDB that stems from malicious code being planted in npm packages that could interfere with cryptocurrency transactions. The following products and versions are affected: duck...

CVE-2025-59037: Embedded Malicious Code

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of DuckDB's packages that included malicious code to...

Embedded Malicious Code

Overview @duckdb/node-api is an API for using DuckDB in Node. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code...

MAL-2025-27605 Malicious code in node-api-test (npm)

The package node-api-test was found to contain malicious code...

MAL-2025-21266 Malicious code in generator-accelerate-node-api (npm)

The package generator-accelerate-node-api was found to contain malicious code...

Malicious code in node-api-test (npm)

The package node-api-test was found to contain malicious code...

GHSA-H746-RM5Q-8MGQ Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

Summary In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API github.com/spiffe/spire/pkg/server/endpoints/node can result in the possible issuance of an X.509 certificate with a URI...

Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

Summary In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API github.com/spiffe/spire/pkg/server/endpoints/node can result in the possible issuance of an X.509 certificate with a URI...

CVE-2021-27098

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

CVE-2021-27098

SPIRE contains an authorization bypass vulnerability in the Legacy Node API FetchX509SVID path. Specifically, before versions 0.8.5, and prior to 0.9.4, 0.10.2, 0.11.3, and 0.12.1, specially crafted requests could cause the server to issue an X.509 certificate with a URI SAN for a SPIFFE ID that ...

CVE-2021-27098: Improper Certificate Validation

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...