← Supply-Chain Attack Compendium

duckdb

Incident Summary

DuckDB npm Account Compromise

The duckdb_admin npm account was compromised via a phishing email linking to a cloned npmjs site (npmjs.help), allowing attackers to bypass 2FA and inject a new API token. The attackers published malicious versions of DuckDB packages containing a wallet-drainer payload, attributed to the same threat actor behind the Qix compromise.

Date
2025-09-09
Category
Open Source
Target Surface
Package registry
Insertion Phase
distribution
Impact
Financial Exploitation
Cause
Social Engineering

What Was Affected

Package duckdb
LanguageJavaScript
ComponentLibrary
Artifact typesource archive
Domain typepackage host
Domain npmjs.com

Compromised Versions

Incident Context

Motive
Financial gain
Attribution
Third Party
Transitive
No
User Impact
369000
Observed Duration
0 days

External References

Source Data

Source record: oss/duckdb/meta.yaml