--- title: TypeScript 7.0 ships, Go gets a malicious module campaign description: TypeScript 7.0 is out with the Go-rewritten compiler, delivering 11.9x faster builds on real codebases. A separate malware campaign called 'Muck and Load'... canonical: https://daily.dev/posts/typescript-7-0-ships-go-gets-a-malicious-module-campaign-gmbzxcbna twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TypeScript 7.0 ships, Go gets a malicious module campaign | daily.dev og:description: TypeScript 7.0 is out with the Go-rewritten compiler, delivering 11.9x faster builds on real codebases. A separate malware campaign called 'Muck and Load'... og:url: https://daily.dev/posts/typescript-7-0-ships-go-gets-a-malicious-module-campaign-gmbzxcbna og:image: https://api.daily.dev/og/posts/GMbZxcbNA.png og:image:alt: TypeScript 7.0 ships, Go gets a malicious module campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TypeScript 7.0 ships, Go gets a malicious module campaign **[Go Digest](https://daily.dev/sources/golang_digest)** · 5 min read · 1 upvotes · 1 comments ## Summary TypeScript 7.0 is out with the Go-rewritten compiler, delivering 11.9x faster builds on real codebases. A separate malware campaign called 'Muck and Load' planted a malicious Go module that pivoted to a network of 222 fake GitHub repositories. On the performance side, two deep dives this week cover zero-copy io.Copy fast paths and mmap vs pread tradeoffs in VictoriaMetrics. The Kubernetes operator space also got a new chaos testing framework and a practical writeup on controller-runtime cache anti-patterns. ## Content **TLDR:** TypeScript 7.0 is out with the Go-rewritten compiler, delivering 11.9x faster builds on real codebases. A separate malware campaign called 'Muck and Load' planted a malicious Go module that pivoted to a network of 222 fake GitHub repositories. On the performance side, two deep dives this week cover zero-copy io.Copy fast paths and mmap vs pread tradeoffs in VictoriaMetrics. The Kubernetes operator space also got a new chaos testing framework and a practical writeup on controller-runtime cache anti-patterns. --- ## TypeScript 7.0 ships with Go-rewritten compiler, 11.9x faster on VS Code's codebase The stable release is out. VS Code's 2.3 million lines now compile in 10.6 seconds, down from 125.7 seconds with TypeScript 6. Editor load times dropped from 17.5 seconds to under 1.3 seconds. The main catch: no programmatic API yet, so frameworks that hook into the compiler directly — Vue, Svelte, Astro, Angular — are staying on TypeScript 6 until 7.1. For straightforward compilation and editor tooling, it's ready today. The team chose Go over C# and Rust partly because Go's structural type system made the port more mechanical than a redesign, and because you can disable the GC for short-lived compilations. [Read more](https://daily.dev/feed-by-ids?id=91LB5GYeE&id=7V1psIuF6) ## 'Muck and Load' campaign: malicious Go module anchors 222-repo GitHub lure network Socket researchers found a malicious Go module impersonating a DNS/subdomain scanner that embedded hidden PowerShell execution, pulling encrypted payloads from Pastebin, YouTube, Instagram, and Telegram. Pivoting from that single module uncovered 222 confirmed GitHub repositories across 190 accounts, all using automated commit-farming Actions workflows to look legitimate. Final payloads included AsyncRAT, Quasar, Remcos RATs, Vidar infostealer, and Monero miners. The module has been blocked from the Go module proxy. If you've pulled unfamiliar Go modules recently, audit your dependencies. [Read more](https://daily.dev/posts/FqwGRWL88) ## Zero-copy io.Copy: wrapping *os.File costs 3.4x more CPU and 44x more syscalls When io.Copy sends a *os.File to a *net.TCPConn, Go's runtime uses sendfile automatically. Wrap that file in any custom io.Reader and you lose the fast path entirely — benchmarks show 3.4x more CPU and 44x more syscalls, confirmed with strace. The only wrapper the runtime explicitly unwraps is io.LimitedReader. The same principle applies to socket-to-socket proxying via splice. If you're writing any proxy or file-serving code, avoid wrapping io.Reader unless you forward io.WriterTo and io.ReaderFrom to preserve zero-copy dispatch. [Read more](https://daily.dev/posts/g6iDMNJLn) ## operator-chaos: 20 failure injection types for testing Kubernetes operator reconciliation Killing pods only validates Kubernetes' built-in Deployment controller, not your operator's reconciliation logic. operator-chaos fills that gap with 20 failure injection types across four categories and four injection modes: CLI black-box, HTTP transport-level, client.Client-level, and per-action pipeline interceptors. A live demo shows cert-manager passing 18/18 experiments. The framework runs a five-phase lifecycle and produces structured verdicts: Resilient, Degraded, Failed, or Inconclusive. Worth looking at if you maintain any operator and haven't tested what happens when the API server returns errors mid-reconcile. [Read more](https://daily.dev/posts/WPOESrwhl) --- ## Also notable - **mmap vs pread in VictoriaMetrics: hybrid approach using mincore() to pick per-page:** VictoriaMetrics uses a hybrid strategy — check page residency with mincore(), use mmap for hot pages already in RAM, fall back to pread for cold pages — because pread costs ~1µs per syscall (adding up to seconds on million-read queries) while mmap can stall Go's scheduler via major page faults that are invisible to the runtime. [Read more](https://daily.dev/posts/0G3E5VmcD) - **database/sql SetMaxOpenConns defaults to zero: 321 failed requests at 150 connections:** A Go service with green CI hit Postgres's default max_connections limit of 100 under load testing with 150 concurrent connections, producing 321 failed requests and 13.5-second worst-case latencies; capping the pool at 25 connections dropped p95 to 32ms and p99 to 92ms with zero failures. [Read more](https://daily.dev/posts/Jpj3UUsYq) - **4 bytes of struct padding makes array clearing 49% faster on Intel CPUs:** When an array sits at a 4-byte offset, Go's REP STOSQ instruction can't hit the ERMSB fast path because 8-byte stores cross every 64-byte cache line boundary, forcing read-for-ownership operations — benchmarks show ~28 GiB/s at aligned offsets vs ~19 GiB/s misaligned on Intel; AMD shows ~9% effect, ARM shows none. [Read more](https://daily.dev/posts/KFkkmfY94) - **5 controller-runtime anti-patterns that silently create cluster-wide informers causing OOMKill:** Patterns like using predicates to filter events (they don't filter cache storage), calling DisableFor without matching Owns()/Watches() registrations, and mismatched typed vs. unstructured watch/get operations all create unfiltered cluster-wide informers; the post includes a 5-step grep-based audit and the ReaderFailOnMissingInformer dev flag to surface phantom watches before production. [Read more](https://daily.dev/posts/TJSFjyvka) - **CircleCI CLI rewritten in Go with built-in MCP server and --json on every command:** The new CLI ships with universal --json and --jq flags on every data-returning command, browser-based OAuth with system keyring storage, a bubbletea TUI for debugging runs, structured error messages with stable exit codes, and a built-in MCP server that integrates with Claude Desktop, Cursor, and VS Code in one command. [Read more](https://daily.dev/posts/Hdh2YOdGT) ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > the missing programmatic API is the part that'll actually bite people, not the benchmark number. we're on a hono plus node stack and half our build tooling walks the AST directly, so we're stuck on tsc 6 until 7.1 ships that back. the speed win is real but adoption's gonna lag way behind the headline number for anyone with custom tooling. ## Similar posts on daily.dev - [TypeScript 7.0 Rewrote Its Compiler in Go. Builds Are Now 10x Faster.](https://daily.dev/posts/typescript-7-0-rewrote-its-compiler-in-go-builds-are-now-10x-faster--x8yxxxlve) · Medium · 5 upvotes · 0 comments - [Malicious Go Module Exposes GitHub Malware Lure Network Span...](https://daily.dev/posts/malicious-go-module-exposes-github-malware-lure-network-span--fqwgrwl88) · Socket · 14 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#kubernetes](https://daily.dev/tags/kubernetes), [#typescript](https://daily.dev/tags/typescript), [#golang](https://daily.dev/tags/golang), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/typescript-7-0-ships-go-gets-a-malicious-module-campaign-gmbzxcbna) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/typescript-7-0-ships-go-gets-a-malicious-module-campaign-gmbzxcbna","headline":"TypeScript 7.0 ships, Go gets a malicious module campaign","text":"TypeScript 7.0 is out with the Go-rewritten compiler, delivering 11.9x faster builds on real codebases. A separate malware campaign called 'Muck and Load' planted a malicious Go module that pivoted to a network of 222 fake GitHub repositories. On the performance side, two deep dives this week cover zero-copy io.Copy fast paths and mmap vs pread tradeoffs in VictoriaMetrics. The Kubernetes operator space also got a new chaos testing framework and a practical writeup on controller-runtime cache anti-patterns.","url":"https://daily.dev/posts/typescript-7-0-ships-go-gets-a-malicious-module-campaign-gmbzxcbna","datePublished":"2026-07-13T04:19:41.039Z","dateModified":"2026-09-13T21:04:33.689Z","author":{"@type":"Organization","name":"Go Digest","logo":"https://media.daily.dev/image/upload/s--8Aro536C--/f_auto,q_auto/v1773839403/logos/golang_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/golang_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"the missing programmatic API is the part that’ll actually bite people, not the benchmark number. we’re on a hono plus node stack and half our build tooling walks the AST directly, so we’re stuck on tsc 6 until 7.1 ships that back. the speed win is real but adoption’s gonna lag way behind the headline number for anyone with custom tooling.","datePublished":"2026-07-15T18:06:56.937Z","url":"https://daily.dev/posts/GMbZxcbNA#c-6G7LHEKR5","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/golang_digest","name":"Go Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Go Digest","item":"https://daily.dev/sources/golang_digest"},{"@type":"ListItem","position":3,"name":"TypeScript 7.0 ships, Go gets a malicious module campaign"}]} ```