
Security News
NVD Quietly Sweeps 100K+ CVEs Into a “Deferred” Black Hole
NVD now marks all pre-2018 CVEs as "Deferred," signaling it will no longer enrich older vulnerabilities, further eroding trust in its data.
Security News
In what can only be described as one of the most impressive technical feats in the programming world this year, Dimitri Mitropoulos, the founder of Michigan TypeScript, has accomplished something previously thought impossible: running the classic 1993 video game Doom entirely within TypeScript's type system.
After a grueling year and a half of development, Mitropoulos has created what is likely the largest TypeScript codebase ever built. The project required processing a staggering 177 terabytes of TypeScript types over a 12-day period just to render the first frame of the game.
"Doom now runs in TypeScript types. What a journey this one's been. All told, it's been a year and a half of hard work to get to today," Mitropoulos announced on X through the Michigan TypeScript account.
Running Doom has become a famous benchmark in the programming and engineering communities. Doom as a milestone is a peculiar badge of honor, with enthusiasts successfully bringing the classic shooter to run on pregnancy tests, refrigerator displays, ATM machines, IKEA smart light bulbs, car dashboards, digital cameras, voting machines, calculators, printers, and even smart thermostats.
TypeScript's type system was expressly not designed for this kind of computational work, which makes Mitropoulos' achievement particularly remarkable as he essentially transformed a system meant only for compile-time type checking into a complete virtual machine capable of executing complex software. This is a bit like using a spellchecker to somehow write an entire novel on its own.
Ironically, the project began with the opposite intention of what it ultimately achieved. According to the project's README, the WebAssembly runtime was originally "built to service a project that aimed to demonstrate why Doom can't run in TypeScript types. Well. The funny thing is... It can."
To put the scale of this project in perspective, the entire collection of TypeScript definition packages from DefinitelyTyped looks minuscule compared to what was required to run Doom in the type system. Mitropoulos' initial calculations suggested he would need to process 1.25 petabytes of TypeScript types over three months, but through "extreme optimizations," he managed to reduce this to 177 terabytes in 12 days.
Some individual TypeScript types in the project were hundreds of thousands of lines long, pushing far beyond the boundaries of what the language was ever designed to do.
To achieve this extraordinary feat, Mitropoulos built an isolated computer system entirely within TypeScript's type system. This included:
At its core, the project is a WebAssembly runtime implemented purely in TypeScript types. The basic idea, as described in the project README, is that "you can turn C code (or just straight WebAssembly) into a TypeScript type (as in, with no JavaScript runtime code) that will compile the instructions and return a result."
The system implemented all 116 WebAssembly instructions needed to run Doom, with the logic alone adding up to 18 million instructions that the type checker had to evaluate one by one. While a typical TypeScript application might have 200,000 to 500,000 type instantiations, this project sustained 20 million instantiations per second for 12 consecutive days.
To make the project possible, Mitropoulos had to temporarily modify the TypeScript compiler during development to remove several safeguards:
With these protections removed, the type checker could consume up to 100GB of memory, but it also meant that even minor errors could cause catastrophic crashes.
Mitropoulos describes the project repository as "basically an active crime scene" with "blood splattered about." In a refreshingly candid admission, he confesses to having "absolutely no emotional attachment to this code and negative-BigInt-zero interest in making it do even more."
"It runs Doom. That's enough. We can all rest easy now," he writes, adding that he "completely stopped working on it the literal second it completed the mission." However, he's still willing to spend time helping others who might want to take the project "to the 'next level' in the future."
Mitropoulos admitted he "didn't even know 10%” of what he would need to make it really happen when he started. To complete the project, he had to build a comprehensive set of tools and features, including:
Perhaps most impressively, the entire engine is implemented with binary two's complement numbers stored in string literals, and because TypeScript only allows iteration of strings from the left, all binary algorithms had to be implemented in reverse.
Mitropoulos has released the entire project as open source on GitHub and has prepared two (yet-to-be-published) additional videos: one explaining why he undertook this seemingly impossible challenge, and another detailing the technical aspects of how he accomplished it. Subscribe to the Michigan TypeScript channel on YouTube if you want to be notified when those videos are available.
As for what comes after you've achieved the seemingly impossible? Mitropoulos hasn't specified his next moonshot, but as the founder of Michigan TypeScript, he's certainly raised the bar for what's possible within the confines of a type system.
For those interested in learning more about this remarkable technical achievement, Mitropoulos invites questions and discussions in the #doom channel on the Michigan TypeScript Discord or via email at doom@michigantypescript.com.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
NVD now marks all pre-2018 CVEs as "Deferred," signaling it will no longer enrich older vulnerabilities, further eroding trust in its data.
Research
Security News
Lazarus-linked threat actors expand their npm malware campaign with new RAT loaders, hex obfuscation, and over 5,600 downloads across 11 packages.
Security News
Safari 18.4 adds support for Iterator Helpers and two other TC39 JavaScript features, bringing full cross-browser coverage to key parts of the ECMAScript spec.