> Markdown version of [/magazine/415-dev-digest-111-npm-i-g-issues](https://www.wearedevelopers.com/magazine/415-dev-digest-111-npm-i-g-issues). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Dev Digest 111 - npm i -g issues **By:** [Chris Heilmann](https://www.wearedevelopers.com/@chris-heilmann) **Published:** April 15, 2024 In last Friday's Dev Digest we looked at some global tech issues, took a deep dive into code assistants, we have a great video about NPM security and want you to tell us your favourite code questions to use in CODE100. ## News and Articles Let's start this edition with some **government and world tech** news. **Europol** reports some [highly sensitive files mysteriously disappeared](https://securityaffairs.com/161416/data-breach/europol-highly-sensitive-files-disappeared.html?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) from their headquarters. the **US State Department** [investigates a similar issue](https://www.bleepingcomputer.com/news/security/us-state-department-investigates-alleged-theft-of-government-data/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and **Poland** launches an [investigation into its previous government’s](https://www.theguardian.com/world/2024/apr/01/poland-launches-inquiry-into-previous-governments-spyware-use?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) use of the [spyware Pegasus](https://en.wikipedia.org/wiki/Pegasus_(spyware)?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). The **German** government [ditches Windows for Linux and LibreOffice](https://www.theregister.com/2024/04/04/germanys_northernmost_state_ditches_windows/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) which reminds me of the [LiMux project](https://en.wikipedia.org/wiki/LiMux?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) 20 years ago. ![](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/67da21ac-27a4-4ad1-8729-4ce51e742e67_1792x1024.jpeg?w=720&fit=max&dpr=2&auto=format) In **AI land** , here's a great [analysis of the the state of generative AI](https://www.thealgorithmicbridge.com/p/the-state-of-generative-ai-2024?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), a complex SEO scam uses [a fake law firm of AI generated lawyers](https://www.404media.co/a-law-firm-of-ai-generated-lawyers-is-sending-fake-threats-as-an-seo-scam/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) sending threats, **Salesforce** released a [detailed explanation of AI infrastructure](https://salesforceventures.com/perspectives/ai-infrastructure-explained/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), it seems that [a lot of "AI" is just outsourcing](https://www.techpolicy.press/dont-be-fooled-much-ai-is-just-outsourcing-redux/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and the case of [Stability AI shows that being a huge success also means paying big cloud bills](https://www.theregister.com/2024/04/03/stability_ai_bills/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). ![](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661cf315eb4efd64e1486bd5_image-9.png?w=720&fit=max&dpr=2&auto=format) Some tech news from **Google** : [The V8 sandbox](https://securityaffairs.com/161622/security/google-v8-sandbox.html?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo)should protect Chrome users better, [Jpegli](https://opensource.googleblog.com/2024/04/introducing-jpegli-new-jpeg-coding-library.html?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) is a new JPEG coding library, [CodeGemma](https://huggingface.co/blog/codegemma?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) is a trained model for code LLMs and [Google Gemini Code Assist](https://cloud.google.com/gemini/docs/codeassist/overview?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) should take on GitHub Copilot. More on that in the code section below. ## Weird code things… ![package](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661cd9b20df2df3af265ce18_package.png?w=720&fit=max&dpr=2&auto=format) [This npm package](https://www.npmjs.com/package/-?activeTab=code&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) has **~700k** installs, **322** packages depend on it and it racks up around **50k** weekly downloads. And the code does - nothing, The reason? It is named - and if you have a typo in your npm install command, it gets pulled instead of the thing you wanted. So, **npm i -g foo** would globally install foo, whereas **npm i - g foo** would install the mystery package. Other tricky package names on npm are [i](https://www.npmjs.com/package/i?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), [g,](https://www.npmjs.com/package/g?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) [install](https://www.npmjs.com/package/install?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and [s](https://www.npmjs.com/package/s?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). So let's make sure we don't add spaces where they shouldn't be. ## Code and Tools ### Spotlight: AI code assistants ![Using GitHub Copilot in your IDE: Tips, tricks, and best practices](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661cf3eeeb4efd64e14926ee_github_copilot_header.png?w=720&fit=max&dpr=2&auto=format) ‍ With Google releasing Gemini Code Assist, let's look at some articles and resources around AI code helpers. - [Am I in The Stack?](https://huggingface.co/spaces/bigcode/in-the-stack?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) - enter your GitHub user name and see which of your code has been indexed to be used by Copilot. - **GitHub** explain how [GitHub Copilot works](https://blog.quastor.org/p/github-copilot-works?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), how [their engineers use it](https://github.blog/2024-04-09-4-ways-github-engineers-use-github-copilot/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and published [best practices on using it in your IDE](https://github.blog/2024-03-25-how-to-use-github-copilot-in-your-ide-tips-tricks-and-best-practices/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). - **Stack Overflow** tells us that developers with AI assistants [need to follow the pair programming model](https://stackoverflow.blog/2024/04/03/developers-with-ai-assistants-need-to-follow-the-pair-programming-model/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). - And implementing [code search is hard](https://blog.val.town/blog/search-notes/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). ![Learn JavaScript.](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661d01db73e7d482d0e21e84_thumbnail.svg?w=720&fit=max&dpr=2&auto=format) And some **JavaScript** things: - [Learn JavaScript](https://web.dev/blog/introducing-learn-javascript?hl=en&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) is a new course by [Mat Marquis](https://hire.wil.to/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) - **Stefan Judis** explains [how to split JavaScript strings with "Intl.Segmenter"](https://www.stefanjudis.com/today-i-learned/how-to-split-javascript-strings-with-intl-segmenter/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) - [Anton Zamay](https://dev.to/antonzo?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) shows how to [implement JavaScript Concepts from Scratch](https://dev.to/antonzo/implementing-javascript-concepts-from-scratch-4623?context=digest&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) ## Videos ![The xz backdoor's incident's impact on the npm ecosystem - video](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661cd9b36de8b49ee9d925b7_YouTube_CWD_Feross_Aboukhadij_with_border.png?w=720&fit=max&dpr=2&auto=format) Hear from **Feross Aboukhadijeh** of Socket about the [xz backdoor kerfuffle](https://gist.github.com/codepo8/a8eceb1468a7310f94b37d0edef589d2/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), how we can protect against attacks, and the importance of developer responsibility in open source security. [Watch it on WeAreDevelopers](/videos/879-coffee-with-developers-with-feross-aboukhadijeh-of-socket-about-the-xz-backdoor). **More videos:** - **Lachlan Miller** has a great 10 minute explanation on [how Vite works](https://www.youtube.com/watch?v=M_edImKoEt8&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) - **Soumaya Erradi** - [Testing web3 applications (53min)](/videos/878-testing-web3-applications) - **Irina Anastasiu** - [What makes a great Software Engineer? (55min)](/videos/863-what-makes-a-great-software-engineer-challenging-our-assumptions-instead-of-talking-about-imposter-syndrome) - **Joana Simoes** - [Navigating roles as as a woman in the tech industry (1h)](/videos/867-from-developer-to-instructor-and-devrel-navigating-roles-as-as-a-woman-in-the-tech-industry) ## Work and Jobs In work news, **Amazon** [cuts hundreds of jobs in cloud computing unit](https://www.cnbc.com/2024/04/03/amazon-layoffs-hundreds-of-jobs-cut-in-cloud-computing-unit.html?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), an older **Microsoft** paper [explains what makes a great software engineer](https://www.microsoft.com/en-us/research/uploads/prod/2019/03/Paul-Li-MSR-Tech-Report.pdf?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), **Posthog** tell us what they learned about [hiring from their first five employees](https://newsletter.posthog.com/p/what-we-learned-about-hiring-from?r=2bjtip&triedRedirect=true&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and developers are [disillusioned by HR](https://www.theguardian.com/money/2024/apr/03/human-resources-hr-departments-us-workers?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) and hire reps of their own. ## Procrastination Corner / Wonderful Weird Web - [Apollo by Daniel Moreno](https://daz.itch.io/apollo?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) is a small but sweet old school platform game - A detailed paper how cryptographers [solved the Zodiac Killer Cipher](https://www.404media.co/cryptographers-who-solved-zodiac-killer-cipher-publish-paper-about-how-they-did-it/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) - [Faces JS](https://github.com/zengm-games/facesjs?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) is a JavaScript library for generating vector-based cartoon faces ## What's happening at WeAreDevelopers… ![code100-unknown-1](https://wearedevelopers.imgix.net/public/magazine/articles/415/images/661cd9b23bd9ca2264e9cd0b_code100-unknown-1.png?w=720&fit=max&dpr=2&auto=format) **CODE100** will be in Manchester on the **22nd of May** as part of [DTX Manchester](https://www.dtxevents.io/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo)! We are looking for [participants](https://www.wearedevelopers.com/events/code100?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo#ticket-1) and [challengers](https://www.wearedevelopers.com/events/code100-challenger?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). Head on over to the official [CODE100 web site](https://code100.dev/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) to learn all about it. ### CODE100 puzzle: Unknown pleasures To celebrate [CODE100](https://code100.dev/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) coming to Manchester, here is our take on the classic [Unknown Pleasures by Joy Division cover](https://puzzles.code100.dev/code100/puzzles/unknown-pleasures/unknown.png?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo). In [this challenge](https://puzzles.code100.dev/puzzles/unknown-pleasures?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo) we ask you to return the amount of black or transparent pixels in the image and return it as an integer. You get the pixel data as a JSON object. And if you [have an idea for a challenge](https://forms.gle/Lq7HTcbw8nHfgZyaA?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9lb2eiuNaWKDfzLaReY89wCNkTNw2U5g3_l8T-dtfm_-yNJjefEs8PI1QAjEXo_Yobz_Zo), you can tell us about it and win tickets for the WeAreDevelopers World Congress! ‍ ## Related Articles - [Dev Digest 105 - Security First](https://www.wearedevelopers.com/magazine/393-dev-digest-105-security-first) - [Dev Digest 110 - XY marks the spotty security](https://www.wearedevelopers.com/magazine/411-dev-digest-110-xy-marks-the-spotty-security) - [Dev Digest 109 -Egg-citing things…](https://www.wearedevelopers.com/magazine/408-dev-digest-109-egg-citing-things) - [Dev Digest 113 - Debugging above the cloud](https://www.wearedevelopers.com/magazine/422-dev-digest-113-debugging-above-the-cloud) ## Related Videos - [WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe](https://www.wearedevelopers.com/videos/2132-wearedevelopers-live-code100-at-wearedevelopers-europe) - [WeAreDevelopers LIVE - Back to CODE100](https://www.wearedevelopers.com/videos/1909-wearedevelopers-live-back-to-code100) - [WeAreDevelopers LIVE - Dapr / Pixels and Generative Art / Open Source and Communities / and more](https://www.wearedevelopers.com/videos/1720-wearedevelopers-live-dapr-pixels-and-generative-art-open-source-and-communities-and-more) - [WeAreDevelopers LIVE - Did AI or JS break the web?, Finding gems in the days of AI and One thing developers really need to know ](https://www.wearedevelopers.com/videos/1352-wearedevelopers-live-did-ai-or-js-break-the-web-finding-gems-in-the-days-of-ai-and-one-thing-developers-really-need-to-know) ## Related Jobs - [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub** - [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/679408-remote-senior-full-stack-engineer) at **Edge Impulse** - [Senior Full Stack Engineer](https://www.wearedevelopers.com/jobs/48289-senior-full-stack-engineer) at **Sensory-Minds GmbH** - [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub** - [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/646086-remote-senior-full-stack-engineer) at **Edge Impulse** - [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/682327-remote-senior-full-stack-engineer) at **Edge Impulse**