
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
github.com/daison12006013/turboscript
A hybrid web framework that combines TypeScript for business logic and Go for runtime execution. TurboScript uses JavaScript VM (goja) to execute TypeScript code at runtime, providing a unique development experience where TypeScript defines the API logic and Go handles the execution engine.
TurboScript was born from a real-world pain point: while building APIs on AWS Lambda with Node.js, I constantly ran into high memory usage and slow cold starts. In contrast, my experience with Go showed me how fast and efficient backend services could be—yet, in my company, Go adoption was a challenge since most developers were comfortable with Node.js and TypeScript, not Go.
I wanted to bring Go's performance and efficiency to teams who prefer TypeScript, without forcing everyone to learn a new language or toolchain. TurboScript lets you write API logic in TypeScript—using familiar patterns and strict typing—while the Go runtime (powered by FastHTTP and goja) delivers maximum speed and concurrency.
With TurboScript, you get:
TurboScript is designed for TypeScript developers who want to build APIs that are both fast and enjoyable to write, while finally unlocking the performance benefits of Go.
turboQuery()
function for direct database updates from route handlersTurboScript delivers exceptional performance with minimal resource usage:
Latest E2E benchmark results (make test-e2e-bench
):
Endpoint | Avg Response Time | Requests/sec | Memory/Allocations |
---|---|---|---|
Root Endpoint (JSON) | 0.92ms | 1298 req/s | 18.6KB / 140 |
Root Endpoint (HTML) | 1.60ms | 715 req/s | 19.1KB / 145 |
Authenticated Endpoint | 15.35ms | 73 req/s | 19.4KB / 146 |
Benchmarks run on Apple M3 Pro (darwin/arm64) using Go 1.23.10. See internal/tests/
for details.
Note: Authenticated endpoints include JWT verification and database queries, resulting in higher response times and allocations.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.