GlassWorm hides malware in invisible characters in npm and VS Code

Aikido reports that the GlassWorm campaign has resurfaced, this time targeting GitHub repositories, npm packages and Visual Studio Code extensions. The payload is concealed inside invisible Unicode characters, so the code looks entirely ordinary during review while executing malicious instructions at runtime. The goal is to harvest credentials, tokens and other secrets from developer environments.

What this means for your business

The attack lands where trust is highest: in the toolchain developers use every day. A compromised developer machine or build server hands the attacker source code, cloud access and production reach without touching a single firewall. For companies that ship software to customers, the risk propagates down the supply chain, along with the notification duties that follow.

Berigo recommends

• Enable detection of invisible and non-printable Unicode characters in code review and in the CI pipeline, so human reading is not the only control.
• Pin dependencies to specific versions and require approval before new packages and extensions are adopted.
• Give developer credentials short lifetimes and move tokens into a secrets manager rather than local environment variables.
• Rotate every token that has been exposed in developer environments and review the logs for unexpected use.

Source

• aikido.dev