--- title: TypeScript 7 rewrites in Go, supply chain worm jumps... description: TypeScript 7 shipped with a full Go rewrite of the compiler, cutting build times roughly 10x — the most concrete validation yet that Go's concurrency model... canonical: https://daily.dev/posts/typescript-7-rewrites-in-go-supply-chain-worm-jumps-ecosystems-kzzbmsnle twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TypeScript 7 rewrites in Go, supply chain worm jumps ecosystems | daily.dev og:description: TypeScript 7 shipped with a full Go rewrite of the compiler, cutting build times roughly 10x — the most concrete validation yet that Go's concurrency model... og:url: https://daily.dev/posts/typescript-7-rewrites-in-go-supply-chain-worm-jumps-ecosystems-kzzbmsnle og:image: https://api.daily.dev/og/posts/kzZbmSnLE.png og:image:alt: TypeScript 7 rewrites in Go, supply chain worm jumps ecosystems og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TypeScript 7 rewrites in Go, supply chain worm jumps ecosystems **[Go Digest](https://daily.dev/sources/golang_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary TypeScript 7 shipped with a full Go rewrite of the compiler, cutting build times roughly 10x — the most concrete validation yet that Go's concurrency model beats raw single-threaded speed for this class of problem. A self-replicating npm worm expanded into the Go ecosystem this week, not by exploiting the toolchain but by hiding payloads in editor config folders of real Go projects. Go 1.26's Green Tea GC and the new `go fix` command are both worth attention if you're running aging codebases or memory-sensitive services. On the performance side, a team documented dropping P99 latency from 50ms to 1.5ms by rewriting a caching layer from Go to Rust — a useful data point for where Go's GC actually hurts. ## Content **TLDR:** TypeScript 7 shipped with a full Go rewrite of the compiler, cutting build times roughly 10x — the most concrete validation yet that Go's concurrency model beats raw single-threaded speed for this class of problem. A self-replicating npm worm expanded into the Go ecosystem this week, not by exploiting the toolchain but by hiding payloads in editor config folders of real Go projects. Go 1.26's Green Tea GC and the new `go fix` command are both worth attention if you're running aging codebases or memory-sensitive services. On the performance side, a team documented dropping P99 latency from 50ms to 1.5ms by rewriting a caching layer from Go to Rust — a useful data point for where Go's GC actually hurts. --- ## TypeScript 7 ships with Go-rewritten compiler, ~10x faster builds Microsoft released TypeScript 7 with the compiler fully ported from JavaScript to Go. The VS Code codebase (roughly 1.3–2.3M lines depending on the source) dropped from 50–125 seconds to 6–10 seconds. The gains come from two places: native machine code execution and shared-memory parallelism via goroutines — no postMessage copying overhead. The language service now restarts in under 2 seconds versus 10–12 for TS 6. One caveat: teams using compiler APIs (Vue, Astro, Svelte) should wait for TypeScript 7.1, which will ship a new native cross-process API. [Read more](https://daily.dev/feed-by-ids?id=x8yxxxLve&id=C43xJRTGV) ## npm worm Shai-Hulud expands into Go ecosystem via editor config folders A self-replicating worm and its descendants (Mini Shai-Hulud, Miasma, Hades) moved from JavaScript into Go this week. The attack didn't touch Go's toolchain — malicious JavaScript payloads were embedded in `.vscode/tasks.json` and `.claude/` folders inside a real Go project (verana-blockchain), triggering automatically when developers opened it in their IDE. Once executed, the payload harvested credentials, cloud keys, SSH keys, and CI/CD secrets. Practical defense: audit hidden config folders before opening unfamiliar repos, use short-lived scoped tokens, and restrict CI/CD permissions. [Read more](https://daily.dev/posts/LqbDNDaaL) ## Go to Rust rewrite drops P99 from 50ms to 1.5ms in caching layer A team that had already migrated from Node.js to Go hit a wall: Go's GC was causing P99 latency spikes of 50–100ms in a high-throughput in-memory cache processing millions of requests per second. They rewrote the cache in Rust using DashMap, eliminating GC pauses entirely. P99 dropped to 1.5ms, memory usage fell 70%, and CPU halved. Their conclusion is worth keeping: Go stays the default for standard microservices, but for extreme latency-sensitive workloads where GC pauses are the bottleneck, Rust is the right call. [Read more](https://daily.dev/posts/MnZbCRfMJ) ## Go 1.26's `go fix` gets real teeth as an automated refactoring tool Go 1.26 revitalizes `go fix` from a legacy migration curiosity into something worth adding to CI. It now handles replacing deprecated `ioutil.ReadAll` with `io.ReadAll`, updating `strings.Title` to the `golang.org/x/text/cases` package, and fixing loop closure issues. Running `go fix ./...` on an aging codebase rewrites outdated patterns in place. If you're maintaining services that haven't been touched in a few years, this is a low-risk first pass before a bigger modernization effort. [Read more](https://daily.dev/posts/DaxeDO5kx) --- ## Also notable - **Go 1.24 Swiss Table maps: 30–35% faster lookups, 60% faster sparse iteration:** Go 1.24 replaced the bucket-and-overflow map design with a Swiss Table-inspired implementation using compact control bytes and group-oriented flat probing — large-map lookups and assignments are ~30–35% faster, iteration up to 60% faster on sparse large maps, though full-application geomean improvement is ~1.5% and cold-cache patterns can regress. [Read more](https://daily.dev/posts/dqMwTph3t) - **Go HTTP client IdleConnTimeout mismatch causes silent production timeouts:** A production incident traced intermittent timeouts to Go's HTTP transport holding idle connections longer than the upstream load balancer's cutoff — pooled connections were silently dropped then handed back as healthy; the fix was setting IdleConnTimeout below the load balancer's threshold. [Read more](https://daily.dev/posts/q21dknunO) - **AttackerKB shuts down August 18, 2026 — Go archival CLI available now:** Rapid7 is shutting down AttackerKB on August 18, taking years of vulnerability assessments with it; a dependency-free Go CLI called attackerkb-archive handles the 100-requests-per-day rate limit with checkpoint-based resumable runs to preserve the data before the API goes dark. [Read more](https://daily.dev/posts/Au6Z42FAv) - **sync.Pool delivers 31% latency reduction at 10k req/s with correct reset pattern:** A practical guide to Go's sync.Pool documents a 31% latency reduction at 10k req/s, and flags the two common mistakes that negate the gains: forgetting to reset pooled objects before reuse, and expecting pool contents to survive GC cycles. [Read more](https://daily.dev/posts/Ovru6S28P) - **pkg.go.dev now has an official OpenAPI spec for programmatic package metadata access:** The pkg.go.dev API exposes package metadata, versions, symbols, vulnerabilities, and import relationships via an official OpenAPI spec, enabling auto-generated Go clients via oapi-codegen — a walkthrough builds a full Bubble Tea TUI explorer against it. [Read more](https://daily.dev/posts/OucBlyUCx) ## Similar posts on daily.dev - [TypeScript 7.0 Rewrote Its Compiler in Go. Builds Are Now 10x Faster.](https://daily.dev/posts/typescript-7-0-rewrote-its-compiler-in-go-builds-are-now-10x-faster--x8yxxxlve) · Medium · 5 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#performance](https://daily.dev/tags/performance), [#typescript](https://daily.dev/tags/typescript), [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/typescript-7-rewrites-in-go-supply-chain-worm-jumps-ecosystems-kzzbmsnle) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/typescript-7-rewrites-in-go-supply-chain-worm-jumps-ecosystems-kzzbmsnle","headline":"TypeScript 7 rewrites in Go, supply chain worm jumps ecosystems","text":"TypeScript 7 shipped with a full Go rewrite of the compiler, cutting build times roughly 10x — the most concrete validation yet that Go's concurrency model beats raw single-threaded speed for this class of problem. A self-replicating npm worm expanded into the Go ecosystem this week, not by exploiting the toolchain but by hiding payloads in editor config folders of real Go projects. Go 1.26's Green Tea GC and the new `go fix` command are both worth attention if you're running aging codebases or memory-sensitive services. On the performance side, a team documented dropping P99 latency from 50ms to 1.5ms by rewriting a caching layer from Go to Rust — a useful data point for where Go's GC actually hurts.","url":"https://daily.dev/posts/typescript-7-rewrites-in-go-supply-chain-worm-jumps-ecosystems-kzzbmsnle","datePublished":"2026-07-27T04:19:54.764Z","dateModified":"2026-09-13T21:12:35.525Z","author":{"@type":"Organization","name":"Go Digest","logo":"https://media.daily.dev/image/upload/s--8Aro536C--/f_auto,q_auto/v1773839403/logos/golang_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/golang_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/golang_digest","name":"Go Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Go Digest","item":"https://daily.dev/sources/golang_digest"},{"@type":"ListItem","position":3,"name":"TypeScript 7 rewrites in Go, supply chain worm jumps ecosystems"}]} ```