Back

DuckDB NPM Account Breached, Malicious Versions Released

The ongoing NPM supply chain attack has extended to DuckDB’s maintainer account, with malicious versions of 'duckdb' and 'duckdb-wasm' containing wallet-stealing malware, though the impact remains limited.

Summary

The DuckDB NPM account was compromised in an ongoing supply chain attack, leading to the release of malicious versions of 'duckdb' and 'duckdb-wasm.' These versions are linked to wallet-stealing malware, but the overall impact appears minimal. Security warnings have been issued as a precaution.

Terms & Concepts
  • NPM: Node Package Manager, a package manager for the JavaScript programming language, used for managing dependencies in software projects.
  • Supply Chain Attack: A type of cyberattack where the attacker targets vulnerabilities in the supply chain of software development, often affecting multiple systems at once.