Glassworm slips fileless malware into 433 github repos using invisible unicode

Glassworm, the quietest data thief in open-source, resurfaced between 3 and 9 March, injecting fileless backdoors into 433 high-star repositories across Python, JavaScript, TypeScript, VS Code extensions and npm. No binaries, no obvious diffs—just zero-width Unicode that masquerades as empty strings.

The campaign, tracked by Aikido Security, weaponises zero-width joiners and zero-width non-joiners: glyphs every editor renders as blank space. Inside that void the group embeds a payload that, once decoded, phones a Solana smart contract to pull down a second-stage script. The result is a classic session hijack—GitHub tokens, crypto wallets, AWS keys—without a single file touching disk.

The trusted repo is the trojan

Victims this wave include Wasmer, the universal WebAssembly runtime; Reworm, the 1 460-star reactive framework; and Anomalyco, custodian of the OpenCode and SST projects. All three pushed commits that looked like routine typo fixes. None triggered a pull-request review because the malicious diff was 100 % whitespace.

Aikido’s analysts ran a diff-only heuristic across 60 000 repos and found the tell-tale variable lzcdrtfxyqiplpd—a Glassworm signature—hidden inside what appeared to be blank lines. The same variable showed up in 200 Python repos, 151 JS/TS repos and 72 VS Code extensions. “Manual crafting at that scale is impossible,” the team notes. They suspect generative models were fine-tuned on each target’s commit history to fabricate plausible changelogs.

Once the invisible string is parsed, a 44-character Solana address is unpacked. A call to getProgramAccount returns an encrypted blob that becomes a Node or Python one-liner, executed immediately in memory. Antivirus never sees a file; CI pipelines pass; maintainers remain oblivious until wallets drain.

Defense means never pip-installing blind

GitHub’s own secret-scanning does not flag zero-width characters, and GPG-signed commits offer no protection—the poison sits inside the content itself. Aikido recommends cloning any repo, running grep -P '[\x{200B}-\x{200D}]' across the tree, and installing Python packages only from isolated containers. For JavaScript, lock to exact npm hashes and audit every patch, however cosmetic it claims to be.

The group’s last rampage peaked in May 2024, then went dark for ten months. This encore proves the technique ages well—and that developer trust is still the cheapest exploit on the market. 433 repos, nine days, zero files detected. The numbers speak louder than any warning.