Glassworm slips invisible code into github’s most starred repos

An old ghost is rattling the JavaScript and Python supply chain again. Security shop Aikido caught the Glassworm crew sprinkling zero-width Unicode glyphs across 423 public repositories this month, turning innocent-looking commits into back-doored time bombs that still pass every code review and every antivirus scan.

The trick is vintage steganography with a modern twist. Attackers hide a second-stage payload inside what your editor renders as a blank string. Once the repo is cloned, a one-liner decodes the invisible characters and fires a fileless script that rifles through Solana wallets, browser cookies and CI secrets. No disk artifact, no signature match, no alarm bell—until the coins are gone.

200 Python repos, 151 npm packages, 72 vs code extensions

Between 3 and 9 March the campaign surged beyond its usual npm playground. Top-hit projects—Wasmer’s server-side runtime, the 1 460-star Reworm fuzzer, Anomalyco’s OpenCode—were all touched. Victims download a “documentation fix” and inherit a credential vacuum cleaner. Because the poison lives in the commit history, even pinning to a supposedly stable tag won’t save you.

Aikido’s engineers reverse-engineered the dropper and found the tell-tale variable lzcdrtfxyqiplpd—Glassworm’s calling card since last summer. The scale screams automation. Crafting 151 bespoke patches by hand is fantasy; the researchers suspect large-language-model assistance, feeding benign changelogs to bots that open pull requests faster than any maintainer can blink.

Corporate firewalls never see the exfiltration: traffic piggybacks on legitimate GitHub domains, then exits through Solana’s RPC gateways. By the time a SOC notices anomalous wallet interactions, the attacker has rotated keys and melted the trail.

Short-term defense is blunt. Clone, grep for Unicode categories Cc and Cf, and never install a package straight from a repo you haven’t personally diffed. Long-term, the ecosystem needs signed commits that cover the entire tree—not just the tip—and package managers that refuse to serve invisible bytes. Glassworm proves, once again, that trust is a vulnerability when code is reviewed by human eyes and deployed by impatient scripts.