As always, only use this code if the browser you’re designing for supports image manipulation via JavaScript (that is, Netscape 3 or later and Internet Explorer 4 or later).

The image, which is displayed to the right of this text, looked unremarkable. Using some clever HTML5 programming under the hood, however, it delivered malicious code to unsuspecting Mac users.

On Wednesday, a collaborative whiteboard app maker called "tldraw" made waves online by releasing a prototype of a feature called "Make it Real" that lets users draw an image of software and bring ...