DuckDB confirms its Node.js and Wasm packages were attacked in the npm supply chain

ChainCatcher news, DuckDB's official Twitter account stated that the DuckDB Node.js and Wasm packages were compromised with malware in a recent npm supply chain attack. The official team has investigated and deprecated the affected versions, while releasing new versions. DuckDB stated that, according to npm data, no users have downloaded the affected packages. The team has released a security announcement detailing the post-analysis and response measures.