
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Sarah Gooding
March 11, 2025
Microsoft has just announced a major shift in the evolution of TypeScript: they are porting the TypeScript compiler and tooling to Go. This transition, dubbed "Project Corsa," is aimed at massively improving performance, reducing memory usage, and enhancing developer experience. With a projected 10x speed increase, this move signals a major change for JavaScript and TypeScript developers alike.
Since its inception, TypeScript has been implemented in TypeScript itself, running on the JavaScript runtime. While this brought benefits like easier contributions and alignment with the JavaScript ecosystem, it also came with limitations. According to Anders Hejlsberg, the lead architect of TypeScript, JavaScript is optimized for UI and browser usage rather than for compute-heavy tasks like compiling large codebases. As a result, TypeScript’s performance has been constrained by:
To address these concerns, Microsoft decided to port TypeScript to a compiled language that better suits its workload.
Everyone wants to know why the Microsoft team selected Go over other language options after hearing the news that TypeScript will is porting its compiler. This question is answered by Hejlsberg in the video announcement (2:30). When considering a new language for the TypeScript compiler, Microsoft explored multiple options, including C, C++, and Rust. However, Go emerged as the best choice for several reasons:
Typescript Team Development Lead Ryan Cavanaugh also answered the "Why Go?" question in a lengthy FAQ announcement on GitHub. Ryan Cavanaugh explained that Go was chosen for the TypeScript compiler port because it allows for a structurally similar codebase, making it easier to maintain both the JavaScript and Go versions side by side.
Unlike a ground-up rewrite, Go’s memory management model simplifies development while maintaining strong control over memory layout. Its ergonomic handling of graph processing is also a major advantage, given TypeScript’s reliance on traversing abstract syntax trees. While Go's JavaScript interop is weaker, the team plans to mitigate this with a more intentional API design, ensuring long-term flexibility and performance improvements.
Early benchmarks show that the new Go-based TypeScript compiler (tsc) delivers order-of-magnitude performance improvements. Here are some real-world examples Microsoft cited:
In editor scenarios, the improvements are just as dramatic. The time to load the entire VS Code project in the TypeScript language service drops from 9.6 seconds to just 1.2 seconds—an 8x improvement. Memory usage is also significantly lower, with further optimizations planned.
The performance improvements stem from two main factors:
Importantly, this is a port, not a rewrite. The TypeScript team is methodically porting the existing compiler "lock, stock, and barrel" to maintain identical semantics and behavior. This ensures that all the implicit behaviors and nuances of TypeScript's type system will remain consistent.
The port is well underway, with over 100,000 lines ported so far:
Microsoft is taking a phased approach to this transition. The roadmap includes:
During the transition, Microsoft will continue maintaining the JavaScript-based TypeScript 6.x series for projects that rely on existing workflows. However, the long-term goal is for the Go-based compiler to fully replace the current implementation.
For TypeScript users, this change promises:
Developers can try the new implementation today by building it from Microsoft’s working repository. As TypeScript 7 approaches, more stability and feature parity updates will follow.
Microsoft’s decision to port TypeScript to Go marks a new era for the language. By overcoming the performance constraints of JavaScript, this transition will deliver a significantly faster and more scalable development experience. While the change will take time to reach full maturity, the early results are promising, making this one of the most exciting developments in the TypeScript ecosystem to date.
For those eager to test it out, check the GitHub repository and stay tuned for updates from the TypeScript team. With a 10x speed boost on the horizon, the future of TypeScript looks incredibly bright.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.