Glassworm hijacks 400+ github repos with invisible unicode strings

Three million lines of code, 400+ repositories, one invisible string. Security firm Aikido has traced a year-long, still-rolling supply-chain assault that hides Solana-draining scripts inside Unicode characters no human eye can see. The campaign, baptised Glassworm, resurfaced between 3 and 9 March with a reach that dwarfs its 2024 wave.

Why your linter sees nothing

The trick is U+200B, U+FEFF and their silent cousins—zero-width spaces that render as blank in VS Code, github’s diff viewer and most terminals. Attackers embed them inside what looks like an empty string literal. When the package is installed, a one-liner stitches the invisible bytes back into executable JavaScript or Python, then phones home to Solana RPC nodes for wallet draining and session hijacking.

Glassworm’s latest haul: 200 Python repos, 151 JavaScript/TypeScript libraries, 72 VS Code extensions, 10 fresh npm packages. Victims include Wasmer, the universal runtime downloaded 30 million times a month; Reworm, a 1 460-star AI sandbox; and Anomalyco, the startup behind OpenCode and SST. Each repo was force-pushed with “documentation tweaks” that carried the hidden payload.

Ai is now the commit author

Manual insertion of 151 bespoke backdoors across unrelated codebases “isn’t feasible at this scale,” Aikido notes. The firm’s honeypot caught pull requests whose commit messages and variable names were spat out by large language models fine-tuned on each target’s style. The bots even mimic typos and indentation quirks, slipping past maintainers who trust green CI badges more than their own eyes.

Once decoded, the malware is fileless: it lives only in RAM, fetches its second stage from a blockchain metadata field and vanishes on reboot. Antivirus engines never touch disk, so they never trigger.

Check your clipboard before you pip install

Aikido’s dead-simple test: clone the repo, open the main file and search for the variable lzcdrtfxyqiplpd. If it exists, you’ve just pulled Glassworm. Better yet, pin dependencies to Git commit hashes instead of branch names, and run pip install only inside an ephemeral container with outbound RPC blocked.

The campaign is still live. New packages appeared on npm hours after the report went public, sporting the same invisible signature. Glassworm’s wallet, visible on-chain, cashed out 214 SOL—about $34 000—during the March spike. The money is gone; the code isn’t.