Skip to main content

TH16132

Detected presence of software components that contain an unusual sequence of special Unicode characters.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passhighhighNoneNone

About the issue​

Unicode is a text encoding standard designed to support the use of text written in all of the major languages and writing systems. Beyond visible letters and symbols, the standard defines many special characters that have no visual representation of their own, such as zero-width characters, variation selectors, bidirectional text controls, and code points reserved for private use. Because most code editors, review tools, and diff viewers display these characters as blank space or omit them entirely, they can be used to hide content in plain sight. Malicious actors abuse this behavior to conceal encoded payloads inside seemingly empty strings, in an attempt to evade manual code review and security tooling. Long or unusual sequences of these characters are rarely found in legitimate code, and often indicate that data was deliberately encoded into invisible text. While presence of special Unicode characters does not imply malicious intent, all of its uses in a software package should be documented and approved. One example of acceptable use for these special characters is in script files that parse, validate, and transform Unicode-encoded text.

How to resolve the issue​

  • Investigate reported detections as indicators of software tampering.
  • Consult Mitre ATT&CK documentation: T1027.018 - Obfuscated Files or Information: Invisible Unicode.
  • Consult publicly available materials on the GlassWorm malware.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • Linux: 562K
  • NPM: 5.12M
  • Nuget: 735K
  • PS Gallery: 17K
  • PyPi: 838K
  • RubyGems: 203K
  • VS Code: 113K
  • Windows: 3.7K
Statistics are not collected for the TH16132 policy at this time, or not applicable to this type of issue.