The TypeScript anomaly

The reports don’t stop at repos. This week, I received one that shook me: TypeScript code compiling into something it was never meant to be.

A developer shared a side-by-side comparison. His original source was clean. But the compiled JavaScript contained calls to unknown endpoints. Not libraries. Not dependencies. Silent requests written by no one.

[2025-02-07 22:44] ts_anomaly.log  
Source: 112 lines  
Compiled: 117 lines (extra calls)  

Those extra calls matter. They weren’t in the source. They weren’t in version control. They weren’t even visible until he traced the compiled output line by line.

It’s one thing for repos to whisper. It’s another for languages themselves to betray their writers.

TypeScript was supposed to be safe. A layer of structure over JavaScript chaos. Instead, it has become another conduit.

If compilers now add their own secrets, then even the code we hold in our hands can’t be trusted.