Supply-chain attack using invisible code hits GitHub and other repositories
New supply-chain attack exploits invisible Unicode code.
Aikido Security researchers have uncovered a sophisticated supply-chain attack involving 151 malicious packages uploaded to GitHub, which utilize invisible Unicode code to bypass conventional security measures. This technique renders malicious functions undetectable in standard code reviews, posing a significant threat to developers who may unknowingly integrate these packages into their software. The attackers, identified as the group Glassworm, are suspected of leveraging AI to craft these deceptive packages, complicating the detection and prevention of such attacks.
Key Takeaways
- 1.
Researchers identified 151 malicious packages uploaded to GitHub in early March.
- 2.
The attack group, dubbed Glassworm, likely uses AI to generate realistic code.
- 3.
Malicious payloads are hidden using invisible Unicode characters, complicating detection.
Get your personalized feed
Trace groups the biggest stories, videos, and discussions into one feed so you can stay current without scanning ten tabs.
Try Trace free