GoKawiil
Tech News
Security researchers at SafeDep discovered that a malicious npm package called mathmain, disguised as a copy of the popular mathjs library, contains a hidden remote access implant. The malicious code stays encrypted and dormant until a specific equation is solved using the library's lusolve() solver function, which acts as a decryption key to unlock and execute the payload.
TechCrunch is closing exhibit table registration for its Disrupt 2026 conference tonight at 11:59 p.m. PT, after which startups can no longer secure a spot in the Expo Hall. The event runs October 13-15 at Moscone West in San Francisco and is expected to draw more than 10,000 founders, investors and tech leaders. A $12,500 exhibit package includes a table for all three days, 10 team passes, lead-generation tools, VC access, press-list access and sponsor branding.
A technical write-up by Vlad Saioc examines how Go's goroutine-based concurrency model can produce 'leaked' goroutines that block indefinitely and never release memory or resources. The piece explains that while tools like the goleak library and Go 1.25's new synctest package help catch such leaks during unit testing, neither can reliably detect leaks in live production systems at scale, leaving goroutine profiles as one of the few practical diagnostic options.
Apple's Swift language team has released Swift 6.4, which makes Swift Build the default engine in Swift Package Manager so projects compile identically on Linux, macOS, and Windows. The update also finalizes the Subprocess API at version 1.0 for cross-platform process management, expands C++ and Java interoperability, and speeds up WebAssembly execution via JavaScriptKit by up to 40 times.
Chipotle developed a High-Efficiency Equipment Package after frontline workers flagged that slow prep and grilling were hurting throughput and consistency. The package, built through rapid R&D iteration and in-restaurant testing, includes a three-pan rice cooker, dual-sided plancha griddle, high-capacity chip fryer, and produce slicer, cutting prep time by hours per restaurant daily. The innovation helped land Chipotle the No. 2 spot on a Best Workplaces for Innovators 2026 list.
A developer examining Git's command-line safety flags found that removing or moving a git worktree containing submodules requires the --force flag, a restriction dating back to git worktree's 2015 introduction. The analysis traces how git worktree add had to be patched to ignore submodule.recurse to avoid corrupting empty submodule paths, and argues that git submodules function as a de facto package manager, with the gitlink SHA acting as a lockfile entry and .gitmodules as the manifest.