GlassWorm: Invisible Unicode Malware and Blockchain C2 Hit 400+ GitHub Repos, npm Packages, and VSCode Extensions

The Story

Between March 3 and March 9, 2026, an attacker compromised developer accounts on GitHub and force-pushed malicious code into at least 151 repositories, including projects from Wasmer, Reworm, and anomalyco (the organization behind OpenCode and SST). The injections targeted Python projects spanning Django apps, ML research code, Streamlit dashboards, and PyPI packages, appending obfuscated payloads to files like setup.py, main.py, and app.py.

The technique that makes GlassWorm different from every other supply chain attack is its steganographic payload delivery. The attacker encodes malicious code inside invisible Unicode Private Use Area characters in the ranges U+FE00 through U+FE0F and U+E0100 through U+E01EF. Every major code editor, terminal, syntax highlighter, diff tool, and linting engine renders these characters as nothing. A backtick string that appears completely empty in your IDE can contain a full malicious payload. No standard code review process will catch it.

Once decoded via JavaScript's eval(), the payload queries a Solana blockchain wallet for command-and-control instructions. The C2 URL is embedded in the memo field of blockchain transactions associated with wallet address BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC. StepSecurity traced 50 transactions on this address dating back to November 27, 2025, with the attacker regularly rotating payload URLs, sometimes multiple times per day. The blockchain serves as an immutable, censorship-resistant C2 channel that traditional network-based takedowns cannot touch.

The campaign extends well beyond GitHub. Socket Research identified 72 malicious Open VSX extensions published between January 31 and March 13, 2026. These extensions mimic legitimate developer tools, including linters, code runners, and AI coding assistant integrations. A third-generation technique abuses the extensionPack and extensionDependencies manifest fields to turn initially benign extensions into transitive delivery vehicles, silently pulling in payload-bearing dependencies after passing marketplace review.

On the npm side, packages including @aifabrix/miso-client and @iflow-mcp/watercrawl-watercrawl-mcp were compromised on March 12. Two React Native packages were also briefly hijacked to push malicious versions directly to the registry without corresponding GitHub releases.

Aikido Security assessed that the campaign likely uses LLM-generated cover commits to disguise the malicious injections. The surrounding changes, documentation tweaks, version bumps, small refactors, and bug fixes, are stylistically consistent with each target project. Crafting 151+ bespoke code changes across different codebases manually is not feasible at this scale. Koi Security independently corroborated this assessment.

The Git injection technique itself is novel. The attacker rebases the latest legitimate commits on the default branch with malicious code, then force-pushes the changes while preserving the original commit message, author, and author date. This leaves no pull request trail, no visible diff in GitHub's UI, and no commit history anomaly unless you compare committer timestamps against author timestamps.

The Adversary Perspective

From a red team standpoint, GlassWorm is a masterclass in layered evasion. Every design choice is optimized to exploit a specific trust assumption in the developer workflow.

The invisible Unicode payload defeats visual code review. No human reviewer can see it. No syntax highlighter marks it. No linter flags it. The only detection path is binary-level analysis of the file contents, something almost no one does on a routine git pull.

The force-push with preserved metadata defeats Git-based change detection. Most supply chain security tooling looks for suspicious commits, new contributors, or pull requests from unknown accounts. GlassWorm skips all of that by overwriting history under the original author's identity.

The Solana blockchain C2 defeats network-based takedowns. You cannot take down a blockchain transaction. The attacker can update the payload URL by posting a new transaction memo, and every infected endpoint will pick up the change within five seconds. Traditional approaches like domain seizures and IP blacklists are irrelevant against this infrastructure.

The transitive dependency abuse in VSCode extensions defeats marketplace review. An extension that passes review cleanly can later silently inherit a malicious dependency without any code change to itself. The trust model of extension marketplaces was not designed for this attack pattern.

Defensive Takeaways