On November 20, developer Ayrton Sparling posted an issue on the GitHub repo for "event-stream" — a JavaScript package that enjoys 1-1.5 million downloads per week and is used in some rather high-profile projects. The issue, simply titled "I don't know what to say", outlined some suspicious behaviour that, after extensive investigation, resulted in the discovery of a bitcoin-stealing payload deviously hidden inside.

Just because you can do something, doesn't mean you should. Like stuffing Windows 95 inside a virtualised JavaScript wrapper so anyone can download it and run it like a regular desktop app. Why would you engage in such insanity? Your guess is as good as mine.

Bookmarklets were all the rage years ago and although they might have been left by the wayside, they're more powerful than ever. Essentially a browser bookmark the runs Javascript, bookmarklets can act as shortcuts for helpful code snippets, saving the hassle of using the developer console or writing an extension.

If you're new to building web apps, check out the first issue of You Got This! a friendly zine from developer community Glitch. The issue teaches the basic concepts behind web servers, and the npm package manager for Javascript. It also features career profiles of three community-leading web developers, and blurbs of advice from a dozen more developers from places such as Google, Mozilla and Slack.

As the parent of a young adult with Type 1 diabetes, I understand some of the challenges folks face when diagnosed with their condition. And, for some kids, it can be hard to teach them about what's happening in their bodies as they navigate the world of insulin, hypo- and hyper- glycaemia, monitoring your blood sugar and managing your diet. Magikcraft is leveraging Minecraft to help engage children diagnosed with Type 1 diabetes in making their way through this new world.

Over at the Oculus developer blog, React VR was just announced, allowing anyone who knows Javascript and React to create virtual 3D environments for websurfers to explore.

The ever-increasing sophistication of coding tools coupled with more powerful hardware makes "live editing" a reality in scenarios that weren't possible ten, or even five years ago. Web development is about as live as it gets and we still have yet to reach the limits of software for this stuff. Take the newly released "Quokka", which provides JavaScript coders with another option for fast experimentation... and it doesn't hurt that it's named after the Australia's most adorable marsupial.

In web development, it's not always easy to keep up-to-date with all the fancy debugging features of modern browsers. That said, a strong command of your browser's development console can take you a long way, if you're sharp with JavaScript.

It was once the case that to do anything fancy with a web page, you needed a healthy dose of JavaScript. However, it's 2016 and HTML and CSS have come a long way. You might be surprised at what you can do without a single line of JS.

Adding more and more small Javascript modules might make things easier on the developer's end, but it might also make things slower on the user's end. Coder Nolan Lawson set out to test how much performance was lost when dealing with not only your own modules, but also dependencies.

Learn the language of the web and get the skills needed to secure a job as a front-end web developer with the Essential JavaScript Coding Bundle. For a limited time, Lifehacker Australia readers can purchase this package for only $38 AUD , a savings of 97% off the RRP.

Ransomware-as-a-service is a relatively new method for cybercriminals to take targeted PCs hostage and demand payment from their owners to recover the files on-board. There have been a few recorded attacks that use this delivery model but a recent type of ransomware-as-a-service, Ransom32, is a little different, mainly because it's Javascript-based which has wider implications for the security community.

Version 2 of Google's application framework for creating mobile and web applications, Angular, is now in beta. While the framework's previous iteration was geared towards making web apps that run in browsers using HTML and Javascript, Angular 2 is aimed at making it easier for developers to build apps for mobiles and desktops.

It used to be this sort of event could only occur in an alternate reality, yet here we are and Microsoft has announced that Chakra, Edge's JavaScript engine, will be open-sourced as of January next year.

Sometimes Stack Exchange just isn't enough for the budding coder -- nothing beats a properly formulated course focusing on the skills and knowledge you need. Pocket-Lint currently has a good deal going for those in the process of improving their JavaScript abilities -- 10 JS-related online courses, normally priced at over $US1100, for just $US11.

Microsoft may have lagged behind when it came to making Internet Explorer a competitive option compared to Chrome and Firefox, but with Edge it's catching up -- fast. The latest improvement is the implementation of asm.js into Edge's Javascript engine, which came in a few months ago as an optional extra, but will soon be switched on by default.

We've all heard of the KISS concept, "Keep It Simple, Stupid", but how exactly does this apply to development? Is it possible to write and maintain a large, complex codebase without losing sight of simplicity? Programming JavaScript Applications author Eric Elliott believes so.

Node.js Foundation has finally released the stable version of Node.js, its open source command line tool for JavaScript. A lot of work has been put into Node.js v4.0 -- here's an overview of what to expect from it.

Like any other programming language, JavaScript has both good parts and bad parts. If you want to avoid the bad parts and learn some best practice coding techniques, check out this free course taught by Douglas Crockford, author of JavaScript: The Good Parts.