GCVE-110-OSM-2025-313

Glassworm threat actor steganographic attack using hidden Unicode variation selectors embedded in pre-start.cjs. Uses invisible Unicode characters to hide malicious payloads that execute when the file is loaded. Campaign targets supply-chain via compromised repositories. Malicious payload found in: pre-start.cjs Attack vector: Glassworm steganographic attack using hidden Unicode variation selectors Decoder signature: 0xFE00&&w<=0xFE0F?w-0xFE00:w>=0xE0100&&w<=0xE01EF (extracts hidden commands from variation selector ranges) Behavior: Embedded JavaScript extracts malicious payloads encoded as Unicode variation selectors (U+FE00-U+FE0F, U+E0100-U+E01EF) that are invisible to human code reviewers but decoded and executed at runtime. Typically used for cryptocurrency theft and credential exfiltration.