Detecting Invisible Code: A 30-Line Scanner for Unicode Steganography

Malicious packages can hide executable payloads using invisible Unicode characters (zero-width spaces, joiners, variation selectors) embedded in string literals, which are then decoded and executed via eval(). Recent campaigns like Glassworm use this technique with blockchain-based C2 infrastructure. Detection is straightforward: a simple scanner checking for sequences of 3+ consecutive invisible Unicode codepoints catches these payloads, since normal code never contains such runs.