Nephila Radar [5/26 | Oct 26 – Nov 8]

Ajeet Singh Raina, Developer Advocate at Docker, wrote part four of the Coding Agent Horror Stories series. This one covers the August 26, 2025 attack on Nx, an npm package with roughly four million downloads a week. The compromised versions looked for Claude Code, Gemini CLI and Amazon Q on the machine and launched them without confirmation prompts to hunt for credentials. GitGuardian counted 2,349 stolen secrets across 1,079 repositories, more than 1,100 of them still valid at the time of the analysis. All it took was an agent running with the developer's permissions and credentials.

Worth reading to understand why an agent that runs as you exposes every credential you have access to: Coding Agent Horror Stories: The 29 Million Secret Problem - Ajeet Singh Raina

Tim Schilling, a member of the Django 6.x Steering Council and maintainer of django-debug-toolbar and django-simple-history, describes contributions where an LLM writes the code, the pull request description and the replies to review comments. At that point, he notes, the reviewer would get the same result by using the LLM directly. To him, AI is a useful aid, including for getting a better grasp of a problem, and he used it for a good part of the new features on djangonaut.space. But it should only be used if contributors understand the ticket, the solution and the feedback they receive. Anyone thinking of helping Django by spending on tokens, he writes, would do better to donate that money to the Django Software Foundation.

Worth reading to understand when an LLM-written contribution helps an open-source project and when it weighs on its maintainers: Give Django your time and money, not your tokens - Tim Schilling

Andros Fenollosa, Product Owner and Full Stack Developer, and author of technical books and free courses, explains why he doesn't recommend Tailwind CSS for medium and large projects. One of his examples is about the cascade: with class="text-red-500 text-green-500" the text turns red, because the order in which the compiler generates the classes in the stylesheet decides, and the order in the HTML plays no part. His advice is to learn native CSS first, which today covers a good part of what Tailwind offers with cascade layers, nesting, :has() and container queries, and to pick the framework afterwards, based on context.

Worth reading to understand the cost you'll pay down the line when you choose Tailwind: Why I don't recommend Tailwind CSS - Andros Fenollosa

Since February 2, 2025, Article 4 of the AI Act has required providers and deployers of AI systems to look after the AI literacy of the people who use them. In her second article on the AI Act, Paola Bianconi, Analyst & Project Manager at Nephila, explains what changed with the Digital Omnibus and walks through our training path: a generative AI course for the whole team, technical and non-technical, a more in-depth path for developers, and a form that collects questions and problems from everyday use.

Worth reading to understand what the AI Act asks for today on training and how we put it into practice: Learning to read AI: what the AI Act says about literacy - Paola Bianconi

taken. is the fourth volume of Since You Arrived, a series of interactive pages created by Matt at Rise Up Labs. All you need is a browser with JavaScript enabled. Open it and the page shows, in real time, what your browser has already revealed to it: the city estimated from your IP address and the data your device hands over through standard APIs, such as screen, language, GPU, battery and installed fonts. For each data point, the notes explain how the page found it out and which other techniques it could have used, such as canvas fingerprinting.

Worth trying to see how much your browser reveals to every site before you even click, and to ask yourself what data the sites you build collect: taken.

***

Avete trovato interessante questo elenco di risorse o volete dirci la vostra? Se volete partecipare alla discussione vi aspettiamo sulla nostra pagina LinkedIn. Il confronto e lo scambio sono la parte che ci piace di più.

***

Abbiamo scritto questo articolo con il supporto dell'AI. Se vuoi saperne di più su come usiamo questi strumenti per la scrittura, ecco la spiegazione.