--- title: jscrambler 8.14.0 ships credential stealer, DuckLake... description: The jscrambler npm package version 8.14.0 was published with a malicious preinstall hook that drops a Rust-compiled credential and crypto-wallet stealer —... canonical: https://daily.dev/posts/jscrambler-8-14-0-ships-credential-stealer-ducklake-hits-100-tps-1n2bicfsx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: jscrambler 8.14.0 ships credential stealer, DuckLake hits 100 TPS | daily.dev og:description: The jscrambler npm package version 8.14.0 was published with a malicious preinstall hook that drops a Rust-compiled credential and crypto-wallet stealer —... og:url: https://daily.dev/posts/jscrambler-8-14-0-ships-credential-stealer-ducklake-hits-100-tps-1n2bicfsx og:image: https://api.daily.dev/og/posts/1N2bicfSx.png og:image:alt: jscrambler 8.14.0 ships credential stealer, DuckLake hits 100 TPS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # jscrambler 8.14.0 ships credential stealer, DuckLake hits 100 TPS **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary The jscrambler npm package version 8.14.0 was published with a malicious preinstall hook that drops a Rust-compiled credential and crypto-wallet stealer — anyone who installed it should treat the host as compromised and rotate everything. DuckLake's architecture Q&A surfaced some concrete numbers worth knowing: roughly 100 TPS concurrency versus about 1 TPS for Iceberg and Delta, with metadata-only migration from Iceberg leaving files in place. The GPU neocloud financing story is worth reading if you're evaluating infrastructure vendors — CoreWeave is running capex at 3.7x revenue with $24.86B in debt. On the runtime front, a new JavaScript runtime called Ant ships as a 9.1 MB binary with a claimed 5.4 ms cold start and its own engine. ## Content **TLDR:** The jscrambler npm package version 8.14.0 was published with a malicious preinstall hook that drops a Rust-compiled credential and crypto-wallet stealer — anyone who installed it should treat the host as compromised and rotate everything. DuckLake's architecture Q&A surfaced some concrete numbers worth knowing: roughly 100 TPS concurrency versus about 1 TPS for Iceberg and Delta, with metadata-only migration from Iceberg leaving files in place. The GPU neocloud financing story is worth reading if you're evaluating infrastructure vendors — CoreWeave is running capex at 3.7x revenue with $24.86B in debt. On the runtime front, a new JavaScript runtime called Ant ships as a 9.1 MB binary with a claimed 5.4 ms cold start and its own engine. --- ## jscrambler npm 8.14.0 contains a Rust-compiled credential and crypto-wallet stealer Version 8.14.0, published July 11, 2026, grew from 37.8 kB to 7.9 MB. The extra bulk is a 7.8 MB file disguised as JavaScript, containing three gzip-compressed platform-specific executables that run via a preinstall hook on Linux, Windows, and macOS. The payload embeds SQLite, LevelDB, and a BIP39 wordlist to target browser credential stores and MetaMask-style wallet extensions, then phones home to Tor infrastructure and two hardcoded IPs. If you installed 8.14.0, treat the host as compromised, downgrade to 8.13.0, rotate all credentials, and audit browser wallet extensions. [Read more](https://daily.dev/posts/Hv0AvwILI) ## DuckLake architecture Q&A: 100 TPS concurrency, metadata-only Iceberg migration The webinar Q&A filled in a lot of operational detail. The concurrency number is the headline: roughly 100 TPS versus about 1 TPS for Iceberg and Delta. Migrating from Iceberg is metadata-only — your Parquet files stay in place — while Delta requires moving data. Schema evolution doesn't rewrite Parquet files either. Caching is RAM-only today with disk extensions coming. The catalog layer supports PostgreSQL, MotherDuck, and the Quack protocol. MIT-licensed; MotherDuck is the managed offering. [Read more](https://daily.dev/posts/yUkY5MGAG) ## CoreWeave runs capex at 3.7x revenue with $24.86B in debt as GPU neocloud financing loops back to Nvidia The structural concern here is circular: Nvidia invests $2B each in CoreWeave and Nebius, backstops CoreWeave's unsold GPU capacity up to $6.3B, and both companies funnel that capital back to Nvidia buying GPUs. CoreWeave's GPU-backed term loans use hyperscaler contracts as collateral to hit investment-grade ratings, but rising Treasury rates are pushing interest expense toward 27% of revenue. Nebius needs $6.3B in additional 2026 funding. Combined hyperscaler commitments exceed $145B. Whether revenue converges with capex before the debt loads become unmanageable is the open question. [Read more](https://daily.dev/posts/tIePBgsBN) ## Ant JavaScript runtime ships with its own engine, 9.1 MB binary, and 5.4 ms cold start Ant is not a V8/JSC/SpiderMonkey wrapper — it's built on its own engine called Ant Silver. The binary is 9.1 MB, runs npm packages and TypeScript natively without a build step, and claims near-V8 performance. The VM-isolated sandbox uses KVM/Hypervisor.framework for untrusted code. The package installer claims up to 40x faster than npm, and there's a companion registry at ants.land that speaks the npm protocol. Cold start is claimed at 5.4 ms. Worth watching, though independent benchmarks are still needed. [Read more](https://daily.dev/posts/OJPqhM0mK) --- ## Also notable - **AI agent token costs more than doubled year-over-year for median customers:** Token usage per request more than doubled year-over-year, driven by full tool catalog loading on every call, unbounded session history, and redundant retrieval loops — the fix requires span-level traces per LLM call and tool invocation, not just aggregate dashboards. [Read more](https://daily.dev/posts/FeJyo9qbG) - **Only 32% of organizations have agentic AI in production, per Confluent's 2026 Data Streaming Report:** 72% of IT leaders cite insufficient real-time data processing infrastructure as the blocker, up from 61% the prior year, and investments in data streaming now outrank AI/ML spend (88% vs 82%). [Read more](https://daily.dev/posts/CWgWwIcl2) - **Machinecraft built a 36-agent system for $30K instead of a quoted $230K:** The system runs on a few thousand dollars per month using RAG with vector and graph databases, a layered memory architecture, and a nightly knowledge consolidation cycle — the architecture is available as a forkable template at forkmybrain.org. [Read more](https://daily.dev/posts/OJn0T2RYi) - **ZeroFS vs S3 Files: S3 Files adds $0.30/GB-month high-performance storage tier, ZeroFS supports multi-cloud:** The practical split: S3 Files keeps a one-to-one file-to-object mapping so files remain accessible as ordinary S3 objects after ~60 seconds, while ZeroFS uses an LSM tree with compressed encrypted segments that are cheaper at scale but lock you out of direct S3 access and are AWS-agnostic. [Read more](https://daily.dev/posts/utccD00gq) ## Similar posts on daily.dev - [jscrambler npm package publishes malicious preinstall binary](https://daily.dev/posts/jscrambler-npm-package-publishes-malicious-preinstall-binary-hv0avwili) · StepSecurity · 2 upvotes · 0 comments - [jscrambler npm Package Compromised in Supply Chain Attack](https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j) · Socket · 0 upvotes · 0 comments - [Hackers backdoor Jscrambler npm package with infostealer malware](https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/jscrambler-8-14-0-ships-credential-stealer-ducklake-hits-100-tps-1n2bicfsx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/jscrambler-8-14-0-ships-credential-stealer-ducklake-hits-100-tps-1n2bicfsx","headline":"jscrambler 8.14.0 ships credential stealer, DuckLake hits 100 TPS","text":"The jscrambler npm package version 8.14.0 was published with a malicious preinstall hook that drops a Rust-compiled credential and crypto-wallet stealer — anyone who installed it should treat the host as compromised and rotate everything. DuckLake's architecture Q&A surfaced some concrete numbers worth knowing: roughly 100 TPS concurrency versus about 1 TPS for Iceberg and Delta, with metadata-only migration from Iceberg leaving files in place. The GPU neocloud financing story is worth reading if you're evaluating infrastructure vendors — CoreWeave is running capex at 3.7x revenue with $24.86B in debt. On the runtime front, a new JavaScript runtime called Ant ships as a 9.1 MB binary with a claimed 5.4 ms cold start and its own engine.","url":"https://daily.dev/posts/jscrambler-8-14-0-ships-credential-stealer-ducklake-hits-100-tps-1n2bicfsx","datePublished":"2026-07-12T04:19:03.955Z","dateModified":"2026-07-12T04:19:37.932Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"jscrambler 8.14.0 ships credential stealer, DuckLake hits 100 TPS"}]} ```