Glassworm hid credential theft in Unicode

Glassworm made source text itself part of the delivery system. In March 2026, the operators hid JavaScript inside invisible Unicode characters, so a reviewer could open the file, see a harmless-looking string, and miss the executable payload entirely. The loader reversed that trick at runtime, decoded the hidden bytes, and handed them to JavaScript for execution.

The first March cluster was mostly a source-repository problem. Aikido found more than 150 GitHub repositories carrying Glassworm-like commits, including the more visible pedronauck/reworm repository. That gave the campaign a quiet staging surface: poisoned code could sit in public trees, pass casual review, and later reach developers who cloned, forked, or vendored the affected projects. The second cluster moved through official distribution channels, where Aikido connected npm packages such as react-native-country-select, react-native-international-phone-number, @aifabrix/miso-client, and @iflow-mcp/watercrawl-watercrawl-mcp, plus the quartz.quartz-markdown-editor VS Code extension. Some artifacts were registry releases with versions and download paths; others were repository commits, and the individual attack records keep those trust boundaries separate.

The payload family focused on developer credentials and execution context. Reports describe staged loaders, Solana-based dead drops, environment-aware execution, and theft from the places a developer workstation or CI runner naturally exposes: tokens, cloud credentials, package-registry secrets, and local configuration files.

The campaign matters because the concealment method attacked the review process itself. Package maintainers could compare a diff and still miss the working code. Security teams had to search for invisible characters, not just suspicious strings, and then map each hit back to the distribution surface that could have put it on a machine.