DuckDB has confirmed that its Node.js and Wasm packages were compromised in a recent npm supply chain attack. The company announced via Twitter that malicious software was embedded in these packages, prompting the deprecation of affected versions and the release of new, secure versions. According to npm data, no users have downloaded the compromised packages. DuckDB has issued a security advisory outlining the incident analysis and response measures taken to address the breach.