Glassworm buries invisible code bombs in 423 github repos, empties wallets in silence

The repo you cloned last Tuesday might already be emptying your Solana wallet while you sip coffee. Researchers at Aikido caught the Glassworm crew slipping Unicode ghosts—zero-width characters that render as blank space—into 200 Python repos, 151 JavaScript/TypeScript libs, 72 VS Code extensions and a fistful of npm packages between 3 and 9 March. The payload hides inside what looks like an empty string; your terminal sees nothing, your linter sees nothing, the blockchain drain is already broadcasting.

Unicode vanishing ink tricks veteran developers

Glassworm first surfaced a year ago, but the March spike is colder, faster, larger. The attackers fork legitimate high-star projects—pedronauck/reworm (1,460 stars), Wasmer, Anomalyco—then push a single innocuous commit: a doc fix, a version bump, a typo. Buried in that diff is the variablelzcdrtfxyqiplpd, a decoder ring spun from invisible characters. Once the string is concatenated at runtime, it phones home, pulls a second-stage script via Solana memo transactions and walks away with session tokens and seed phrases. No files touch disk, so antivirus never blinks.

Aikido’s manual triage stopped at 423 repos; the real number is anyone’s guess. The firm’s verdict is blunt: ‘At this scale, hand-crafting 151 bespoke code changes is impossible. They’re using LLMs to rewrite history, then laundering reputation through star-count halo.’ Translation: the machines that help us write code are now writing the malware that steals our code money.

Check your dependencies before they check your balance

There is no glossy UI warning. The only reliable test is to clone the repo, grep for Unicode ranges U+200B-U+200D and U+FEFF, then run the package inside an isolated Python venv. If the variable lzcdrtfxyqiplpd pops up, burn the directory and rotate every key you own. Aikido has published a one-liner scanner; 30 seconds beats waking up to a zeroed Phantom wallet.

GitHub’s security team yanked the malicious commits within hours, but forks travel faster than takedowns. The code is gone, the history remains, and Glassworm is already choosing its next 400 repos. The silent characters are still out there—typing themselves into your dependencies while you read this.