The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties

Aikido describes a campaign where attackers hide malicious JavaScript in invisible Unicode Private Use Area characters appended to otherwise legitimate-looking GitHub commits; the payload (Glassworm) uses Solana as a delivery channel to fetch and execute code that can steal tokens and credentials, and the technique builds on earlier npm and Open VSX supply-chain compromises while evolving to be more stealthy (single-line obfuscation, likely AI-generated commit content).