# May #37: npm Supply Chain Worm Returns, Claude Opus 4.7 Tops… Canonical: https://brew.new/browse/templates/email/pt1_k97van56zsdejtexqb3xe8m0958e555n Brand: frontendmasters.com Category: newsletter ![Preview of May #37: npm Supply Chain Worm Returns, Claude Opus 4.7 Tops…](https://cdn.brew.new/email-preview-c1e5d26157429ef3-tracking_r57gjqgn0x8tr01rg0jtg46c598dtj7t-1789002352043.png) ## Email content Hi there, Welcome to Frontend to Fullstack Monthly #37! Here is your curated roundup of the most important news, releases, and learning resources from across the web for April, all chosen to be worth your time. Industry News The 'Mini Shai-Hulud' npm supply chain attack is still unfolding. On April 29, attackers published malicious versions of four SAP CAP packages and the widely used intercom-client SDK, with the malware harvesting GitHub, npm, and cloud credentials. The new wrinkle: it injects .claude/settings.json and .vscode/tasks.json files so opening an infected repo in Claude Code or VS Code triggers execution. Rotate credentials if you ran npm install on April 29 or 30. Claude Opus 4.7 shipped April 16 and is the strongest publicly available model for coding right now. Anthropic reports 87.6% on SWE-bench Verified, up from 80.8%, with Cursor and Rakuten confirming the gains on real workloads. Pricing is unchanged at $5 / $25 per million tokens. One catch: agentic web research regressed, so GPT-5.4 Pro is still ahead there. Starting in June, Google will penalize sites that 'hijack' the back button in search results. GitHub is also testing a new 'Stacked PRs' feature in private preview to break large changes into smaller dependent parts. ✨ Recent releases to be aware of: TypeScript 7.0 Beta, pnpm 11, Git 2.54, Playwright 1.59.0, Phaser 4.0, Rspack 2.0, and Google's ADK for Go hit 1.0. Tutorials and Articles Does the new, cross-browser sizes="auto" spell the end of messy srcset/sizes headaches? Neciu Dan runs through the relevant new additions in JavaScript (and what's coming next) in a useful ES2025 and ES2026 round-up. Vedant Gandhi wanted to better understand how Docker containers work under the hood, so he set out to build a minimal one in Go from scratch. Google's Addy Osmani has shared some pointers for AEO, which stands for Agentic Engine Optimization. Here's the behind-the-scenes story of rebuilding the frontend of MDN. Kilian Valkhof shares a neat code-heavy primer on what we can do with the Intl API. Harry Roberts clarifies how inheritance works when loading in font stacks, and it might not work as you expect. One developer took on a rather ambitious folly: installing every Firefox extension. Turns out there's 84 thousand of them and some of them have rather weird behavior. New on Frontend Masters AI Engineering Fundamentals with Scott Moss from Netflix Discover the discipline of AI Engineering and build better AI features that get more accurate over time. Establish rigorous eval harnesses to improve AI agents through context engineering, advanced tool use, RAG, and reliable production feedback loops. Senior Level Frontend Interview Prep with Staff Engineer Evgenni Ray Prepare for the rigorous frontend interviews Big Tech is known for. Work through complex JavaScript, TypeScript, and UI Component challenges while learning strategies that help junior, senior, and staff-level engineers land that dream job! Enterprise UI Development: Microfrontends, Testing, & Code Quality with Steve Kinney Architect large, successful frontend systems. From monoliths to microfrontends to monorepos, learn best practices for maintaining complex codebases while shipping high-quality software. Conversations on AI We chatted with a couple FAANG engineers about AI and where they think software engineering is headed and posted them on YouTube: AI Engineering with Scott Moss (Netflix) AI and the Future of Programming with Staff Engineer Evgenni Ray Blog Updates Sure, you're using AI to code, but are you good at it? There is a lot to know. Our recent free workshop Claude Code Deep Dive is testament to that. Durgesh has some articles this month that demonstrate how being too loose with your AI usage can generate inaccessible code or insecure code. But a good team lead should be able to align and guide AI usage well. Adam Rackis has an upcoming course on TanStack, and he's augmenting it with how-to articles using it, like this two parter on building a blog with TanStack. Rob Levin is back as well, this time focused on just how important Constructable Stylesheets are for a big design system using shadow DOM web components. And Ana shares the stuff she wishes she had known when first getting into SVG filters. We started the month off with What To Know in JavaScript (2026 Edition), which is meant to be a look at the whole JS ecosystem and catch you up on where things are at, focusing mainly on what's new. Amit Sheen had an absolute banger month. First with some bonafide trickery of cutting an element into puzzle pieces. Then some ultra practical modern advice about how modern CSS has moved beyond page-level breakpoints. Best for last: HTML-in-Canvas is… incredible. If you haven't heard of this yet, brace yourself, it's pretty wild seeing canvas-style filters over top a perfectly functional web form. The idea of using @container for scoping alone is rather appealing. Yes, we have @scope too, but that's tied to selectors. Giving an element a specific name to scope styles to feels right. Useful Projects Cloudflare recently launched a new tool that will scan your site and determine how 'agent-ready' it is. Aube is another new Node.js package manager, but is notably from the creator of Mise. It's a fast, security-focused drop-in replacement, and boasts being the fastest option right now. HyperFrames is an open-source video rendering framework for creating videos from just HTML and JavaScript. It features a variety of blocks/components for common video effects and elements, and isn't tied to any specific framework. watgo is a new Web Assembly toolkit for Go. It comes with a CLI and a Go API to parse WebAssembly Text, validate it, and encode it into WASM binaries. µCSS is a lightweight and themeable CSS framework. It includes default class-less styles in 20 different themes, a dark mode toggle, 36 pre-built components, and more. delphitools is a charming collection of over 40 browser-based tools. Think things like a palette generator, background remover, image converter, SVG optimizer, line-height calculator, Tailwind CSS shade generator, and more. ...and finally This is delightful. Neal Agarwal's latest is Cursor Camp, a live website where your mouse pointer hangs out around a campfire with everyone else's cursors in real time. No goal, no game, just cursors being cursors together. A pure social experiment, and weirdly soothing. Have something we should feature next month? Reply and send it our way. -- Marc Grabanski CEO & UI Developer Frontend Masters 📲 Take Frontend Masters courses on your phone or tablet using our iOS and Android apps – you can even download our courses to learn offline: Frontend Masters iOS App Frontend masters Android App You received this email because you signed up for Frontend Masters and care about advancing your development skills. If you're no longer interested in updates, you can update your preferences or unsubscribe. Your friends: Frontend Masters, 60 South 6th St, Minneapolis MN 55402 [Open and remix this design](https://brew.new/browse/templates/email/pt1_k97van56zsdejtexqb3xe8m0958e555n) [Browse email designs](https://brew.new/browse/templates)