Supply-chain attack using invisible code hits GitHub and other repositories

Researchers at Aikido Security discovered 151 malicious packages uploaded to GitHub, NPM, and Open VSX between March 3–9, 2026, as part of a supply-chain attack campaign attributed to a group called Glassworm. The packages use invisible Unicode characters to hide malicious code from editors, terminals, and code review tools, Show more