high2025-09-09 CVE-2025-59037-DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware GHSA-w62p-hx95-gf2c