How to effectively detect and mitigate Trojan Source attacks in JavaScript codebases with ESLint

This report explains the Trojan Source attack that leverages Unicode bidirectional control characters (e.g., RLO, LRO, zero-width spaces) to obfuscate malicious source code—covering variants like Stretched String, Commenting-Out, Invisible Functions, and Homoglyph Function—providing JavaScript examples and links to proofs-of-concept. It also documents detection and mitigation options (anti-trojan-source npm scanner, eslint-plugin-anti-trojan-source, IDE/GitHub warnings) and notes ecosystem responses and resources for further reading.