---
id: 2496
title: "duckdb npm packages compromised"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/duckdb-npm-packages-compromised"
published_at: "2025-09-09 00:00"
tags: ["supply-chain", "malware", "npm", "aikido", "incident", "duckdb"]
phying_url: "https://phying.com/item/2496"
lang: en
---

# duckdb npm packages compromised

## Summary

Compromised duckdb npm packages—duckdb, @duckdb/node-api, @duckdb/node-bindings, @duckdb/duckdb-wasm—shipped malicious versions carrying the same payload as the earlier 2-billion-download npm breach.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-09-09 00:00
- **Original:** https://www.aikido.dev/blog/duckdb-npm-packages-compromised
- **Phying News:** https://phying.com/item/2496