CVE-2025-59037: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59037 is a supply chain compromise affecting DuckDB's Node.js npm packages, in which an attacker published malware-laced versions of four packages designed to interfere with cryptocurrency transactions. The incident occurred on September 8, 2025, when a DuckDB maintainer was phished via a pixel-perfect clone of the npmjs.com website, allowing the attacker to obtain an npm API token and publish malicious packages. The affected packages and versions are @duckdb/node-api@1.3.3, @duckdb/node-bindings@1.3.3, duckdb@1.3.3, and @duckdb/duckdb-wasm@1.29.2. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-506 (Embedded Malicious Code): an attacker gained unauthorized access to the DuckDB npm publisher account through a phishing attack using a pixel-perfect clone of npmjs.com (hosted at npmjs.help), then used a stolen API token to publish trojanized package versions. The malicious code was embedded directly into the published npm packages and was designed to intercept and manipulate cryptocurrency transactions on affected systems. The attack required active user interaction — specifically, a developer installing or updating to the compromised package versions — making it a classic software supply chain attack (GitHub Advisory).

The malicious packages contained code intended to interfere with cryptocurrency transactions, posing high confidentiality and integrity risks to any Node.js application that installed the compromised versions. Successful exploitation could allow an attacker to silently redirect or manipulate crypto transactions processed by the affected application. According to npm download statistics, no users downloaded the malicious packages before they were deprecated, limiting real-world impact in this instance (GitHub Advisory, Red Hat).

There is no evidence of a public proof-of-concept exploit, and no confirmed in-the-wild exploitation has been reported. The EPSS score is approximately 0.041%, reflecting low probability of exploitation. The malicious packages were deprecated and removed from npm within hours of publication, and npm statistics indicated zero downloads before removal. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat).

1. Phishing the maintainer: The attacker sent a convincing phishing email from a domain mimicking npm support (...@npmjs.help), directing a DuckDB maintainer to a pixel-perfect clone of npmjs.com.
2. Credential and 2FA capture: The maintainer logged in with credentials and completed 2FA on the fake site; the site acted as a transparent proxy, forwarding all actions to the real npm while also capturing session data and injecting a new API token.
3. API token abuse: Using the newly added API token, the attacker authenticated to the real npm registry and published malicious versions of four DuckDB packages (@duckdb/node-api@1.3.3, @duckdb/node-bindings@1.3.3, duckdb@1.3.3, @duckdb/duckdb-wasm@1.29.2).
4. Malware delivery: Any developer running npm install or npm update targeting these packages would receive the trojanized versions containing code to intercept and manipulate cryptocurrency transactions.
5. Impact on end users: Applications using the compromised packages could have their cryptocurrency transaction logic silently altered, potentially redirecting funds to attacker-controlled wallets (GitHub Advisory).

• Package/File System: Presence of @duckdb/node-api@1.3.3, @duckdb/node-bindings@1.3.3, duckdb@1.3.3, or @duckdb/duckdb-wasm@1.29.2 in node_modules or package-lock.json.
• Logs: npm install logs referencing any of the above version strings; audit logs showing installation of these specific versions.
• Network: Unexpected outbound network connections from Node.js processes to unknown cryptocurrency-related endpoints or wallet addresses.
• Process Behavior: Anomalous behavior in cryptocurrency transaction handling within applications using the affected DuckDB npm packages, such as unexpected address substitution or transaction redirection (GitHub Advisory).

Users should immediately upgrade to the safe re-released versions: duckdb@1.3.4, @duckdb/node-api@1.3.4, @duckdb/node-bindings@1.3.4, and @duckdb/duckdb-wasm@1.30.0 or higher. As an alternative, downgrading to duckdb@1.3.2 / @duckdb/duckdb-wasm@1.29.1 is also safe. Run npm audit to check for the presence of affected versions, and verify package-lock.json does not reference the compromised versions. Organizations should also review npm account security practices, including phishing-resistant 2FA (e.g., hardware keys) and restricting publish access via granular API tokens (GitHub Advisory, GitHub Release).

The DuckDB team published a detailed postmortem in their GitHub Security Advisory, transparently acknowledging they fell for a classic phishing attack and outlining their immediate response steps, including deprecating affected versions, engaging npm support for deletion, and rotating credentials. The incident was covered in security newsletters such as Secret CISO, highlighting it as part of a broader wave of npm supply chain attacks targeting cryptocurrency-related functionality. The DuckDB team noted the attack was detected within four hours and that no downloads of the malicious packages were recorded, which was widely noted as a fortunate outcome (GitHub Advisory, Secret CISO).