What is Package?

Code someone else wrote that your app installs and uses. Installing it runs their code on your machine.

Where Package goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Working with your AI agent · 4 minutes · Pro
The package that did not exist
Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.
Can an AI suggest a malicious npm package?
Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.
Read the fix
Keeping it running · 4 minutes · Pro
Update everything, deploy nothing
You asked your AI to 'update everything to the latest versions'. The app runs on your laptop, but the deploy fails and the live site is stuck on the old version.
Why does my build fail after updating packages?
Usually because a package jumped a major version, which can change how it works, or because package.json and the lockfile no longer match, so the build server installs different versions than your laptop or refuses to install. Update one package at a time, read upgrade notes for major versions, and commit the lockfile with package.json.
Read the fix
Bills that explode · 4 minutes · Pro
2 million requests from one tab
You left your dashboard open overnight. Your database usage page shows 2 million requests from a single browser.
Why is my useEffect fetching in an infinite loop?
The effect changes one of its own dependencies, for example setting a state object it depends on, so every run triggers another run. Remove the self-update, depend only on values that really change, and watch the Network tab for repeating requests. Select only the columns you display to reduce data transfer.
Read the fix
Into the app stores · 4 minutes · Pro
The update that crashed on launch
You pushed an over-the-air update to add a camera feature, skipping the app store. Within an hour, reviews say the app closes the moment it opens.
Why does my Expo update crash the app?
Over-the-air updates replace only your app's JavaScript. If the update uses a package with native code, like a camera, installed apps don't have that code and crash on launch. Roll the update back, ship the feature in a new store build, and let Expo set runtimeVersion from a fingerprint so mismatched updates aren't delivered.
Read the fix
Keeping it running · 4 minutes · Pro
The AI that went quiet
Your app's Summarise button worked for months. Since Saturday it spins, then shows nothing. You haven't changed a line.
What does OpenAI insufficient_quota mean?
insufficient_quota is a 429 error that means your OpenAI account ran out of prepaid credits or hit its spend limit. Retrying will not help: calls fail until credits are added or the limit is raised. Set up a balance alert or auto-recharge, keep a spend cap, and alert yourself whenever an AI call fails.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Git, commit, repository: Git saves snapshots (commits) of your code in a repository, so you can see history and go back.
Lockfile: A file that pins the exact versions of every package, so installs don't change silently.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

All 62 terms in the glossary

Where Package goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Working with your AI agent · 4 minutes · Pro

The package that did not exist

Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.

Can an AI suggest a malicious npm package?

Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.

Read the fix

Keeping it running · 4 minutes · Pro

Update everything, deploy nothing

You asked your AI to 'update everything to the latest versions'. The app runs on your laptop, but the deploy fails and the live site is stuck on the old version.

Why does my build fail after updating packages?

Usually because a package jumped a major version, which can change how it works, or because package.json and the lockfile no longer match, so the build server installs different versions than your laptop or refuses to install. Update one package at a time, read upgrade notes for major versions, and commit the lockfile with package.json.

Read the fix

Bills that explode · 4 minutes · Pro

2 million requests from one tab

You left your dashboard open overnight. Your database usage page shows 2 million requests from a single browser.

Why is my useEffect fetching in an infinite loop?

The effect changes one of its own dependencies, for example setting a state object it depends on, so every run triggers another run. Remove the self-update, depend only on values that really change, and watch the Network tab for repeating requests. Select only the columns you display to reduce data transfer.

Read the fix

Into the app stores · 4 minutes · Pro

The update that crashed on launch

You pushed an over-the-air update to add a camera feature, skipping the app store. Within an hour, reviews say the app closes the moment it opens.

Why does my Expo update crash the app?

Over-the-air updates replace only your app's JavaScript. If the update uses a package with native code, like a camera, installed apps don't have that code and crash on launch. Roll the update back, ship the feature in a new store build, and let Expo set runtimeVersion from a fingerprint so mismatched updates aren't delivered.

Read the fix

Keeping it running · 4 minutes · Pro

The AI that went quiet

Your app's Summarise button worked for months. Since Saturday it spins, then shows nothing. You haven't changed a line.

What does OpenAI insufficient_quota mean?

insufficient_quota is a 429 error that means your OpenAI account ran out of prepaid credits or hit its spend limit. Retrying will not help: calls fail until credits are added or the limit is raised. Set up a balance alert or auto-recharge, keep a spend cap, and alert yourself whenever an AI call fails.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Git, commit, repository

Git saves snapshots (commits) of your code in a repository, so you can see history and go back.

Lockfile

A file that pins the exact versions of every package, so installs don't change silently.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.