Is @duckdb/duckdb-wasm safe to use?

@duckdb/duckdb-wasm has 2 known vulnerabilities on the latest version (1.33.1-dev45.0). DepScope rates its health at 67/100 (moderate risk).

What is the latest version of @duckdb/duckdb-wasm?

The latest version of @duckdb/duckdb-wasm is 1.33.1-dev45.0, released 2026-04-13.

Does @duckdb/duckdb-wasm have known vulnerabilities?

Yes. @duckdb/duckdb-wasm has 2 known vulnerabilities. See depscope.dev/pkg/npm/@duckdb/duckdb-wasm for details.

Is @duckdb/duckdb-wasm deprecated?

No, @duckdb/duckdb-wasm is actively maintained. Latest release: 1.33.1-dev45.0 (2026-04-13).

What are alternatives to @duckdb/duckdb-wasm?

Popular alternatives to @duckdb/duckdb-wasm in npm include: semver, debug, ansi-styles, minimatch, brace-expansion.

What license does @duckdb/duckdb-wasm use?

@duckdb/duckdb-wasm is licensed under MIT.

@duckdb/duckdb-wasm

npmv1.33.1-dev45.0

DuckDB powered by WebAssembly

License MITpermissive438 versions2 maintainers2 deps222,390 weekly dl

duckdb/duckdb-wasm

/ 100

Health

do not use

@duckdb/duckdb-wasm has critical vulnerabilities — do not use

Update to >= 1.30.0 to fix known vulnerabilities

Moderate health score (67/100) — verify manually
1 high severity vulnerabilities
1 critical vulnerabilities

Health breakdown0 – 100

25/25

maintenance

14/20

popularity

10/25

security

15/15

maturity

3/15

community

Vulnerabilities

1 critical1 high

Advisories (2)

Severity	ID	Summary	Fixed in
high	CVE-2025-59037	DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware	1.30.0
critical	MAL-2025-46991	Malicious code in @duckdb/duckdb-wasm (npm)	—

Bundle & TypeScript

📦

Bundle Size

194.1 KBminified

44.3 KB gzipped

2 direct dependencies

ESMscoped

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (2)

qs apache-arrow

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@duckdb/duckdb-wasm