Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Repositories
aikido.dev
March 15, 2026
4 min read
62/100
Summary
Glassworm malware has re-emerged, compromising over 150 GitHub repositories, npm, and VS Code through the use of hidden Unicode characters. This resurgence follows previous activity traced back to the same threat actor, highlighting ongoing vulnerabilities in these platforms.
Key Takeaways
- Glassworm has returned with a new wave of attacks, compromising over 150 GitHub repositories, as well as npm and VS Code marketplaces.
- The attacks utilize invisible Unicode characters to encode malicious payloads within seemingly empty code snippets, which are decoded and executed at runtime.
- The compromised repositories include notable projects, indicating a significant risk of downstream supply chain impacts.
- Attackers are likely employing large language models to generate realistic commit changes, making detection more challenging.
Coverage & discussions
Hacker News · aikido.dev
Community discussions
Community Sentiment
Concerns
- Invisible Unicode characters complicate text processing and can lead to security vulnerabilities, raising concerns about the integrity of code repositories.
- The lack of automated rules to detect zero-width characters indicates a significant oversight in repository security practices, potentially exposing users to hidden attacks.
- Relying solely on repository operators to guard against Unicode-based attacks is unrealistic; proactive measures are necessary to ensure community safety.
Related Articles
Config Files That Run Code: Supply Chain Security Blindspot
Jun 8, 2026
Keyv and friends compromised in active Shai-Hulud supply chain attack
Aug 4, 2026
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
Apr 30, 2026
Mythos Attempted to Social Engineer Open Source Maintainer to Merge Malware
Aug 7, 2026
I found 10k GitHub repositories distributing Trojan malware
Jun 18, 2026