GCVE-110-OSM-2025-310

Glassworm threat actor steganographic attack using hidden Unicode variation selectors embedded in eslint.config.js.bak. Uses invisible Unicode characters to hide malicious payloads that execute when the file is loaded. Campaign targets supply-chain via compromised repositories. Malicious payload found in: eslint.config.js.bak Attack vector: Glassworm steganographic attack using hidden Unicode variation selectors Decoder signature: 0xFE00&&w<=0xFE0F?w-0xFE00:w>=0xE0100&&w<=0xE01EF (extracts hidden commands from variation selector ranges) Behavior: Embedded JavaScript extracts malicious payloads encoded as Unicode variation selectors (U+FE00-U+FE0F, U+E0100-U+E01EF) that are invisible to human code reviewers but decoded and executed at runtime. Typically used for cryptocurrency theft and credential exfiltration.