DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malwaregithub.com/duckdb395 pointstosh9 months ago