--- title: Glassworm Returns: Invisible Unicode Malware Found in... description: The Glassworm threat actor has returned with a new wave of supply chain attacks, compromising 150+ GitHub repositories, npm packages, and VS Code extensions... canonical: https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories | daily.dev og:description: The Glassworm threat actor has returned with a new wave of supply chain attacks, compromising 150+ GitHub repositories, npm packages, and VS Code extensions... og:url: https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu og:image: https://api.daily.dev/og/posts/7qAB3XlzU.png og:image:alt: Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 2 upvotes · 0 comments ## Summary The Glassworm threat actor has returned with a new wave of supply chain attacks, compromising 150+ GitHub repositories, npm packages, and VS Code extensions using invisible Unicode characters. The technique hides malicious payloads inside what appear to be empty strings using Private Use Area (PUA) Unicode characters, which are then decoded and passed to eval() at runtime. Past payloads used Solana as a delivery channel to steal tokens and credentials. The March 2026 wave shows signs of AI-assisted cover commits that mimic legitimate project activity, making visual detection nearly impossible. Detection requires dedicated malware scanning tools rather than standard code review or linting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Supply-chain attack using invisible code hits GitHub and other repositories](https://daily.dev/posts/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories-s42bqymdx) · Ars Technica · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories","url":"https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu"},"datePublished":"2026-03-15T17:50:47.999Z","dateModified":"2026-03-15T17:51:26.488Z","description":"The Glassworm threat actor has returned with a new wave of supply chain attacks, compromising 150+ GitHub repositories, npm packages, and VS Code extensions...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad66e3307eacbcc25ec0884d1af0d0a0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad66e3307eacbcc25ec0884d1af0d0a0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/glassworm-returns-invisible-unicode-malware-found-in-150-github-repositories-7qab3xlzu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,malware,npm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories"}]} ```