Re: Scientific American: Open Source infected with malware from invisible Unicode characters

On 3/22/26 03:10, Karl Williamson via perl5-porters wrote:
> Open-source software has an invisible vulnerability. Hackers have found it
> A cybercrime campaign called GlassWorm is hiding malware in invisible 
> characters and spreading it through software that millions of developers 
> rely on The danger in the code came from characters that are invisible 
> to the human eye. In early March researchers at several security firms 
> examined what looked like empty space and found hidden Unicode 
> characters that decoded into a malicious program. Investigators soon 
> traced hundreds of compromised open-source components spread across 
> GitHub, npm and
> 
> Read in Scientific American: https://apple.news/ACCjFPpifQlCNSMetYCJ2Dg


It appears to be Russian in origin, as it avoids infecting Cyrillic text.

 From 
https://www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/

... The latest GlassWorm attack wave is far more extensive, though, and 
spread to:

     200 GitHub Python repositories
     151 GitHub JS/TS repositories
     72 VSCode/OpenVSX extensions
     10 npm packages

Initial compromise occurs on GitHub, where accounts are compromised to 
force-push malicious commits.

Then, malicious packages and extensions are published on npm and 
VSCode/OpenVSX, featuring obfuscated code (invisible Unicode characters) 
to evade detection.

... Step Security advises developers who install Python packages 
directly from GitHub or run cloned repositories to check for signs of 
compromise by searching their codebase for the marker variable 
“lzcdrtfxyqiplpd,” an indicator of the GlassWorm malware