Supply-chain attack using invisible code hits GitHub and other repositories(arstechnica.com)

14 pointsby tannhaeuser4 mesi fa4 comments

Supply-chain attack using invisible code hits GitHub and other repositories

https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/

5 comments

rogual4 mesi fa

Weird article. The author talks about Unicode "public use areas" (which don't exist), clarifies that they're sometimes called "public use access" (a term appearing only in this article) and are invisible while also being used for flags and emojis and also having special meaning to JavaScript interpreters and also representing letters in the "US alphabet".

There's a real vulnerability here but whoever wrote this has no idea what they're talking about.

sigseg1v4 mesi fa

Can anyone recommend any OSS tooling that could be used in something like a GH action workflow to automatically screen for these types of static attacks on code? Seems like something that should be part of an automated review pipeline if it's getting so hard for humans to visually review against this kind of stuff.

IneffablePigeon4 mesi fa

A linter that disallows any code that uses eval in any form seems like a good start to me.

sigseg1v4 mesi fa

What about for languages that allow pretty much anything in identifiers or variables. JS for example. Or bash. Don't need eval to do anything crazy there.

testacccount14 mesi fa