Poisoned Pipeline

Poisoned Pipeline / Incidents / AS170

AS170 · 2026-02

DuckDB npm account compromised

npm Git / GitHub

Socket: DuckDB npm account compromised in a continuing supply-chain attack.

Mapped techniques

T0113 Compromised user account
T0121 Compromised legitimate artifact

supply-chain campaign

T0113 · Initial Access · Compromised user account

npm account.

T0121 · Resource Development · Compromised legitimate artifact

DuckDB packages.

Sources

https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack