Unicode

Code You Cannot See: GlassWorm and the End of "Review Will Catch It"

GlassWorm hides executable code inside Unicode characters that render as nothing at all. It spread through VS Code extensions, self-propagating with stolen credentials, and reached 35,800 installs. Here is why the characters are invisible, where you step on them, and how to defend once visual review no longer works.