
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@vulcan-sql/extension-driver-duckdb
Advanced tools
Duckdb driver for Vulcan SQL
Install package
npm i @vulcan-sql/extension-driver-duckdb
Update vulcan.yaml, enable the extension.
extensions:
duckdb: '@vulcan-sql/extension-driver-duckdb'
Create a new profile in profiles.yaml or in your profiles' paths.
- name: duck # profile name
type: duckdb
connection:
# Optional: Path to your persistent DB, if this value is not set, we use in-memory database. (default: ":memory:")
persistent-path: 'path-to-a-folder'
# Optional: Whether log query requests (default: false)
log-queries: false
# Optional: Whether log query requests' parameters, please be aware that query parameters might contain sensitive data (default: false)
log-parameters: false
# Optional: Contains the configuration parameters DuckDB need (ex: for duckdb extension "httpfs", it will needs region, accessKeyId, ...)
# You can read more in the [duckdb extension page](https://duckdb.org/docs/extensions/overview)
configuration-parameters:
region?: string
accessKeyId?: string
secretAccessKey?: string
# alternative option for accessKeyId and secretAccessKey
sessionToken?: string
endpoint?: string
url_style?: string
use_ssl?: boolean
Environment Variables
FAQs
duckdb driver for Vulcan SQL
The npm package @vulcan-sql/extension-driver-duckdb receives a total of 10 weekly downloads. As such, @vulcan-sql/extension-driver-duckdb popularity was classified as not popular.
We found that @vulcan-sql/extension-driver-duckdb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.Ā It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.