---
id: 2481
title: "The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties"
published_at: "2025-10-31 00:00"
tags: ["supply-chain", "malware", "github", "npm", "open-vsx", "glassworm", "pua-unicode"]
phying_url: "https://phying.com/item/2481"
lang: en
---

# The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties

## Summary

Aikido tracked one threat actor from npm and Open VSX to GitHub: commits with null emails hide payloads in invisible PUA Unicode, executed via eval within seemingly legitimate feature updates.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-10-31 00:00
- **Original:** https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties
- **Phying News:** https://phying.com/item/2481