duckdb npm packages compromised

Overnight on September 9th, multiple npm packages (including duckdb and a wasm build) were observed with new malicious releases (versions 1.3.3 and 1.29.2) containing a payload that attempts to drain cryptocurrency wallets; the incident appears to be a supply-chain compromise likely achieved via phishing, and the vendor has deprecated the releases and issued an advisory.