@latest tag points to dev version instead of stable version

[mootari]

What happens?

The @latest tag on npm currently points to 1.29.1-dev132.0 instead of 1.29.0.

It seems very likely that the wrong tag was updated by accident, since @next still points to 1.29.1-dev131.0.

To Reproduce

Visit any of the referenced links.

Browser/Environment:

n/a

Device:

n/a

DuckDB-Wasm Version:

latest

DuckDB-Wasm Deployment:

n/a

Full Name:

Fabian Iwand

Affiliation:

Observable

[mbostock]

To clarify, the @latest tag is what is installed by default if you run the following command:

npm i @duckdb/duckdb-wasm

Currently this means that when people install DuckDB-Wasm via npm, by default they get 1.29.1-dev132.0, which was released two months ago, and is neither the latest stable or the latest stable release. I don’t think this is what you intend, but the download stats show that this version is indeed quite popular and 20 times more popular than your @next tag.

Can you please run this command to fix your npm dist tags as I noted back in January? It takes just a second and will ensure that users get the latest stable version by default.

npm dist-tag add @duckdb/duckdb-wasm@1.29.0 latest

[mootari]

@carlopi Can we assist in any way to help resolve this issue?

[mbostock]

It has been almost a year since the last stable release 1.29.0 (October 7, 2024), and the latest tag is still pointing to an arbitrary unstable version (1.29.1-dev132.0) that is five months old (April 8, 2025). Can we get an update here, please? Will there be a stable release soon? Can you please repoint the latest tag to the last stable release 1.29.0? Or if you are no longer doing stable releases, can you point to the latest release instead of using a next tag? Thank you.

[mootari]

@next is now pointing to the latest stable release 1.30.0, while @latest points to a version 1.29.2 that has been deprecated with the message "Security breach". 🤔

[carlopi]

Thanks for checking, @latest should also be re-pointing to 1.30.0, going to change that.

[carlopi]

@mootari: there is more context at GHSA-w62p-hx95-gf2c

[carlopi]

This should be properly solved now:

% npm dist-tag ls @duckdb/duckdb-wasm
latest: 1.30.0
next: 1.30.0

Thanks for the ping

[mootari]

Thank you!

[azu]

Just to confirm, is the DuckDB wasm extension not affected by this vulnerability and safe to use?

For example, when using the spatial extension from @duckdb/duckdb-wasm with a query like the following, it downloads the wasm file from a URL like this:

INSTALL spatial;

Downloaded wasm URK: https://extensions.duckdb.org/v1.1.1/wasm_eh/spatial.duckdb_extension.wasm

Is it correct to understand that this wasm file is not specifically affected?

---

📝 Since many people will likely see the article at https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack and search GitHub, I recommend pinning an announcement issue.

[mootari]

@azu The upload of those extensions appears to be managed through the duckdb/duckdb repo. I don't think they would have been affected by the advisory, but if you're concerned I suggest opening an issue there.

[carlopi]

@azu: extensions are NOT effected, those are build, signed and distributed directly by DuckDB Labs, and have a different distribution models than npm packages.

[mootari]

@carlopi I'm afraid this still seems to be an issue. @latest still points to 1.30.0, while @next points to 1.31.0.

[carlopi]

@mootari: thanks for the ping. I'll sort this out (again)