--- title: Prefect acquires Dagster, Jscrambler npm package... description: Prefect has acquired Dagster, uniting the two biggest Airflow rivals under one roof and framing the deal as a bet on AI agent infrastructure rather than data... canonical: https://daily.dev/posts/prefect-acquires-dagster-jscrambler-npm-package-backdoored-with-infostealer-ol8zc7z9t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Prefect acquires Dagster, Jscrambler npm package backdoored with infostealer | daily.dev og:description: Prefect has acquired Dagster, uniting the two biggest Airflow rivals under one roof and framing the deal as a bet on AI agent infrastructure rather than data... og:url: https://daily.dev/posts/prefect-acquires-dagster-jscrambler-npm-package-backdoored-with-infostealer-ol8zc7z9t og:image: https://api.daily.dev/og/posts/ol8Zc7Z9T.png og:image:alt: Prefect acquires Dagster, Jscrambler npm package backdoored with infostealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Prefect acquires Dagster, Jscrambler npm package backdoored with infostealer **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary Prefect has acquired Dagster, uniting the two biggest Airflow rivals under one roof and framing the deal as a bet on AI agent infrastructure rather than data pipelines. A compromised Jscrambler npm package was downloaded 1,479 times before detection, with the attacker adapting within hours to bypass --ignore-scripts entirely. Amazon SQS turned 20, and the milestone post is worth reading for the concrete capability changes: FIFO queues now scale to 70,000 TPS, max message size grew from 256 KiB to 1 MiB, and fair queues landed for multi-tenant workload isolation. Cloudflare launched Precursor, a session-level behavioral bot detection engine that monitors entire visits rather than single CAPTCHA checkpoints. ## Content **TLDR:** Prefect has acquired Dagster, uniting the two biggest Airflow rivals under one roof and framing the deal as a bet on AI agent infrastructure rather than data pipelines. A compromised Jscrambler npm package was downloaded 1,479 times before detection, with the attacker adapting within hours to bypass --ignore-scripts entirely. Amazon SQS turned 20, and the milestone post is worth reading for the concrete capability changes: FIFO queues now scale to 70,000 TPS, max message size grew from 256 KiB to 1 MiB, and fair queues landed for multi-tenant workload isolation. Cloudflare launched Precursor, a session-level behavioral bot detection engine that monitors entire visits rather than single CAPTCHA checkpoints. --- ## Prefect acquires Dagster, frames deal as AI agent infrastructure play Prefect has acquired Dagster, keeping Dagster's products, pricing, and roadmaps intact with 40 employees joining. CEO Jeremiah Lowin is explicit that this isn't a data pipeline consolidation: Dagster handles goal-setting and outcome tracking, Prefect handles execution, and FastMCP governs what agents can access. Both companies had already been pivoting toward agentic workloads before the deal. Dagster founder Nick Schrock, who had stepped back to CTO in 2022, is departing entirely despite being listed as a strategic advisor in the announcement. [Read more](https://daily.dev/posts/7TrEdPl6I) ## Jscrambler npm package backdoored, attacker bypassed --ignore-scripts within hours Malicious versions of the Jscrambler npm package (8.14, 8.16, 8.17, 8.20) were downloaded 1,479 times over a two-hour window. The infostealer targeted developer credentials, cloud secrets across AWS, Azure, GCP, and Kubernetes, AI coding tool configs for Claude, Cursor, and Windsurf, and cryptocurrency wallets. The attacker's adaptation is the part worth paying attention to: the first releases used a preinstall hook that npm 12's new default would have blocked, but within hours the same Rust-built payload moved into normal package code at dist/index.js, bypassing --ignore-scripts entirely. If you installed any of the affected versions, treat the environment as compromised and rotate all secrets — upgrading the dependency is not sufficient if the payload already ran. [Read more](https://daily.dev/feed-by-ids?id=bLf8gD33M&id=0pL2lqvZC) ## Amazon SQS turns 20: FIFO now at 70,000 TPS, max message size up to 1 MiB SQS launched July 13, 2006 alongside EC2 and S3. The anniversary post is a useful changelog: FIFO high-throughput mode scaled from 3,000 to 70,000 TPS, the JSON protocol cut latency by up to 23%, FIFO in-flight message limits grew from 20,000 to 120,000, and the max message payload increased from 256 KiB to 1 MiB. Fair queues for multi-tenant workloads — preventing noisy neighbor issues — are the most operationally relevant recent addition for teams running shared infrastructure. [Read more](https://daily.dev/posts/Eor4p7rMI) ## Cloudflare Precursor monitors entire sessions to catch bots, reclassifies AI crawler traffic Cloudflare's Precursor injects a lightweight JavaScript bundle that collects mouse movement, keyboard timing, and scroll behavior throughout a full session rather than at a single CAPTCHA checkpoint. Signals are evaluated on the edge and fed into Cloudflare's bot score in real time; session-scoped data means bots can't reset by refreshing. Alongside Precursor, Cloudflare is reclassifying AI bot traffic into search, agent, and training categories, with new sites defaulting to blocking training and agent bots on ad-bearing pages from September 15. Bots now account for 57% of web traffic by Cloudflare's measurement. [Read more](https://daily.dev/feed-by-ids?id=Xhy2Mv8Qf&id=nbBSjorI2) --- ## Also notable - **lobste.rs migrated from MariaDB to SQLite in production, halved VPS costs:** The migration, which took roughly a year, deployed successfully on July 11th after a failed first attempt caused by full table scans and an N+1 query; post-migration results show lower CPU and memory usage, and the MariaDB server decommission will cut VPS costs in half. [Read more](https://daily.dev/posts/5HlAwQYUh) - **Meta's sched_ext BPF scheduler cut p99 ads retrieval latency 28%, saved 3.28 MW:** Using the BPF-based extensible scheduler merged in Linux v6.12, Meta soft-partitioned CPUs into latency-critical and background pools to work around EEVDF regressions introduced in kernel v6.9, with follow-on user-space-only policy updates adding a further 60% p99 latency reduction and 18% fewer timeout errors. [Read more](https://daily.dev/posts/P1rWSKOt7) - **CISA contractor exposed 844 MB of AWS GovCloud keys in a public GitHub repo for six months:** GitGuardian sent nine automated alerts that went unanswered before KrebsOnSecurity intervened; CISA's zero-trust logging confirmed no customer data was accessed, and the postmortem is the first time a national cybersecurity agency publicly advocated for continuous secrets scanning. [Read more](https://daily.dev/posts/6QCogkyQT) - **Aurora PostgreSQL index rebuild via Blue/Green + NVMe: 60% lower latency, 37% higher throughput on production:** Running REINDEX CONCURRENTLY on an isolated green environment with NVMe-backed db.r6gd instances rebuilt an 8,918 MB bloated index to 4,557 MB in ~4 minutes while keeping production query latency 60% lower and throughput 37% higher compared to rebuilding directly on the production instance. [Read more](https://daily.dev/posts/AhlOQJc3J) - **DoorDash Ask assistant: 24% higher grocery checkout conversion, regression testing cut from 6 hours to 20 minutes:** The system combines MCP-based tooling, a three-tier memory architecture, and over 2,000 daily automated conversation evaluations; production results also include 17% larger basket sizes, 7% fewer conversational turns, and a 35% latency reduction. [Read more](https://daily.dev/posts/w3gyrfrce) ## Similar posts on daily.dev - [Hackers backdoor Jscrambler npm package with infostealer malware](https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#cloudflare](https://daily.dev/tags/cloudflare), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/prefect-acquires-dagster-jscrambler-npm-package-backdoored-with-infostealer-ol8zc7z9t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/prefect-acquires-dagster-jscrambler-npm-package-backdoored-with-infostealer-ol8zc7z9t","headline":"Prefect acquires Dagster, Jscrambler npm package backdoored with infostealer","text":"Prefect has acquired Dagster, uniting the two biggest Airflow rivals under one roof and framing the deal as a bet on AI agent infrastructure rather than data pipelines. A compromised Jscrambler npm package was downloaded 1,479 times before detection, with the attacker adapting within hours to bypass --ignore-scripts entirely. Amazon SQS turned 20, and the milestone post is worth reading for the concrete capability changes: FIFO queues now scale to 70,000 TPS, max message size grew from 256 KiB to 1 MiB, and fair queues landed for multi-tenant workload isolation. Cloudflare launched Precursor, a session-level behavioral bot detection engine that monitors entire visits rather than single CAPTCHA checkpoints.","url":"https://daily.dev/posts/prefect-acquires-dagster-jscrambler-npm-package-backdoored-with-infostealer-ol8zc7z9t","datePublished":"2026-07-14T04:18:14.537Z","dateModified":"2026-07-14T04:18:33.229Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Prefect acquires Dagster, Jscrambler npm package backdoored with infostealer"}]} ```