DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware