Is @duckdb/duckdb-wasm safe to use?

@duckdb/duckdb-wasm has 2 known vulnerabilities on the latest version (1.33.1-dev45.0). DepScope rates its health at 40/100 (high risk).

What is the latest version of @duckdb/duckdb-wasm?

The latest version of @duckdb/duckdb-wasm is 1.33.1-dev45.0, released 2026-04-13.

Yes. @duckdb/duckdb-wasm has 2 known vulnerabilities. See depscope.dev/pkg/npm/@duckdb/duckdb-wasm for details.

No, @duckdb/duckdb-wasm is actively maintained. Latest release: 1.33.1-dev45.0 (2026-04-13).

Popular alternatives to @duckdb/duckdb-wasm in npm include: ?, semver, minimatch, debug, brace-expansion.

@duckdb/duckdb-wasm is licensed under MIT.

npmv1.33.1-dev45.0

DuckDB powered by WebAssembly

License MITpermissive440 versions2 maintainers2 deps411,568 weekly dl

/ 100

Health

do not use

@duckdb/duckdb-wasm has critical vulnerabilities — do not use

Update to >= 1.30.0 to fix known vulnerabilities

Advisories (2)

Severity	ID	Summary	Fixed in
high	CVE-2025-59037	DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware	1.30.0
critical	MAL-2025-46991	Malicious code in @duckdb/duckdb-wasm (npm)	—