--- title: "TypeScript 7.0 RC lands in Go, North Korea targets Go modules" url: https://daily.dev/posts/typescript-7-0-rc-lands-in-go-north-korea-targets-go-modules-fcln7l3pz source_url: https://daily.dev/posts/typescript-7-0-rc-lands-in-go-north-korea-targets-go-modules-fcln7l3pz type: freeform source: "Go Digest" published: 2026-07-06T04:20:06.065Z updated: 2026-07-06T04:20:22.160Z tags: ["security", "typescript", "golang", "webrtc"] reading_time: 4 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TypeScript 7.0 RC lands in Go, North Korea targets Go modules **[Go Digest](https://daily.dev/sources/golang_digest)** · 4 min read · 2 upvotes · 0 comments ## Summary TypeScript 7.0 hit release candidate this week — the compiler rewrite in Go delivers roughly 10x faster builds, with stable release expected within a month. A North Korea-linked supply chain campaign called PolinRider has expanded into Go modules, with 162 malicious artifacts found across 108 packages hiding payloads in fake font files and VS Code task configs. Go 1.26 is out with Green Tea GC as the default, promising 10–40% lower GC overhead for production services. OpenAI also published a detailed writeup on how they serve voice AI to 900 million weekly users using a Go relay built on SO_REUSEPORT and pre-allocated buffers. ## Content **TLDR:** TypeScript 7.0 hit release candidate this week — the compiler rewrite in Go delivers roughly 10x faster builds, with stable release expected within a month. A North Korea-linked supply chain campaign called PolinRider has expanded into Go modules, with 162 malicious artifacts found across 108 packages hiding payloads in fake font files and VS Code task configs. Go 1.26 is out with Green Tea GC as the default, promising 10–40% lower GC overhead for production services. OpenAI also published a detailed writeup on how they serve voice AI to 900 million weekly users using a Go relay built on SO_REUSEPORT and pre-allocated buffers. --- ## TypeScript 7.0 RC: compiler rewritten in Go, ~10x faster builds Microsoft shipped the release candidate for TypeScript 7.0, the first version of the compiler rewritten in Go. The speedup comes from native code execution and shared-memory parallelism across parsing, type checking, and emit — roughly 10x faster than TypeScript 6.0. A stable programmatic API won't land until 7.1, but a compatibility shim (@typescript/typescript6) lets both versions coexist. Final release is expected within a month. Worth watching if you maintain any tooling that shells out to tsc. [Read more](https://daily.dev/posts/Xyzb6yCXV) ## PolinRider: North Korea-linked campaign plants malware in Go modules Socket and JFrog independently documented a North Korea-linked supply chain campaign that has expanded from npm into Go modules, Packagist, and Chrome extensions. Researchers found 162 malicious release artifacts across 108 packages. The attack hides JavaScript loaders inside fake .woff2 font files and triggers execution via VS Code task files that auto-run on folder open — bypassing the lifecycle script detection most tools rely on. Payloads use TRON and Aptos blockchain RPCs as dead-drop infrastructure to retrieve second-stage malware that steals browser credentials, GitHub tokens, crypto wallets, and cloud storage metadata. If you've pulled any unfamiliar Go modules recently, treat the environment as compromised, rotate secrets from a clean machine, and audit your VS Code task configs. [Read more](https://daily.dev/feed-by-ids?id=6HetdRGL4&id=xKZgY7UCD) ## Go 1.26 ships with Green Tea GC as default Go 1.26 makes Green Tea GC the default, with the team claiming 10–40% reduction in GC overhead for production services — no code changes required. Other additions worth noting: an experimental goroutine leak profiler (building on what 1.27 formalizes), heap base address randomization, faster cgo calls, and three new standard library packages including crypto/hpke and runtime/secret. The rewritten go fix tool also gains a source-level inliner for library migration paths. cmd/doc is removed in favor of go doc. [Read more](https://daily.dev/posts/EeI6x0bGf) ## How OpenAI serves voice AI to 900M users with a Go relay OpenAI published the architecture behind their WebRTC voice infrastructure. The relay is stateless and written in Go, using SO_REUSEPORT, runtime.LockOSThread for thread pinning, and pre-allocated buffers — no kernel bypass. The clever bit is encoding destination metadata into the ICE ufrag field so the relay can forward the first packet to the right transceiver without a database lookup. Worth reading if you're building any real-time or low-latency Go services; the tradeoffs around SFU vs TURN vs custom relay are explained clearly. [Read more](https://daily.dev/posts/dyaTZVNEs) --- ## Also notable - **Gin at 12 years: radix tree routing, zero broken APIs, 88k stars:** Gin's creator wrote up the original design decisions — radix tree router for O(k) lookups, sync.Pool for Context objects, and a strict backward compatibility promise modeled on Go's own — explaining how a framework built in 2014 for a failed startup still compiles unchanged today. [Read more](https://daily.dev/feed-by-ids?id=HPYKJID1s&id=xsMofoBsS) - **Go singleflight for cache stampede prevention:** A practical walkthrough of wiring golang.org/x/sync/singleflight into a cache-aside pattern covers the key pitfalls: don't pass a caller's context into the shared call, don't mutate the shared return value, and measure coalescing effectiveness via the shared bool before deciding whether you need Redis-level coordination. [Read more](https://daily.dev/posts/0L7XM5yYL) - **etcd-operator v1alpha2 donated to Cozystack, drops StatefulSet management:** The rewritten etcd-operator abandons StatefulSet-based member management for direct use of etcd's Membership API, adds scale-to-zero, CEL-based CRD validation without webhooks, and ships an in-place migration tool (etcd-migrate) that upgrades from v1alpha1 without quorum loss. [Read more](https://daily.dev/posts/Tc8dzITg3) - **shenv: age-encrypted .env sharing via git, no server required:** shenv is a Go CLI that encrypts .env files with age, commits the ciphertext to git, and decrypts only for teammates whose public keys are in a recipients.shenv file — with a shenv run command that injects secrets directly into a process without ever writing plaintext to disk. [Read more](https://daily.dev/posts/BXWVV70iW) --- Tags: [#security](https://daily.dev/tags/security), [#typescript](https://daily.dev/tags/typescript), [#golang](https://daily.dev/tags/golang), [#webrtc](https://daily.dev/tags/webrtc) [View this post on daily.dev](https://daily.dev/posts/typescript-7-0-rc-lands-in-go-north-korea-targets-go-modules-fcln7l3pz)