Supply Chain · PiniShv

Glassworm Is Back. Your Code Review Won't Catch It.

Sun, 22 Mar 2026 20:00:00 +0200

Between March 3 and 9, 2026, Aikido Security documented 151 malicious packages uploaded across GitHub repositories, npm, and the VS Code/Open VSX marketplace. The campaign is called Glassworm, and it’s back for a second wave after first appearing in March 2025.

What makes Glassworm different from most supply chain attacks is the technique. The malicious payload is invisible. Not obfuscated. Not minified. Invisible.

I’ve been writing about AI security threats and supply chain risks for a while. Glassworm is the kind of attack that should change how you think about what “reviewing code” actually means.

How it works
#

Unicode has a range called the Private Use Area (PUA): characters from U+FE00 to U+FE0F and U+E0100 to U+E01EF. These characters are valid Unicode. They exist in the spec. But they don’t render. Not in VS Code. Not in your terminal. Not in GitHub’s diff view. Not in any standard code review interface.

Glassworm encodes malicious JavaScript payloads as sequences of these invisible characters, stuffed inside what looks like an empty string. The actual code in the file looks something like this:

const s = v => [...v].map(w => (
 w = w.codePointAt(0),
 w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 :
 w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null
)).filter(n => n !== null);

eval(Buffer.from(s(``)).toString('utf-8'));

Those backticks at the end look empty. They’re not. They contain hundreds of invisible PUA characters that, when decoded by the function above, produce a full malicious payload. The eval() executes it at runtime. No visible trace in the source file.

The decoded payloads steal tokens, credentials, and secrets, using Solana blockchain as the command-and-control channel to make the exfiltration harder to trace and block.

Why this is harder to catch than you think
#

Traditional code review fails completely against this. A human looking at the diff sees a small utility function and an empty string. Syntax highlighting doesn’t flag it. Linting doesn’t catch it because the characters are valid Unicode. Grep doesn’t find it because you can’t search for characters you can’t see.

AI code review tools face the same problem. They operate on the visible text of the code. If the malicious content is invisible characters inside a string literal, the model sees an empty string. The Anthropic Code Review tool that launched this month dispatches agents to analyze PRs for bugs and security issues. But if the payload isn’t visible in the code representation the model receives, it doesn’t get analyzed.

And Glassworm’s operators are making detection even harder. The visible parts of malicious commits, the parts humans and AI can see, are deliberately convincing. Documentation tweaks. Version bumps. Minor bug fixes. Stylistically consistent with the target repository. Security researchers believe attackers are using LLMs to generate these cover changes at scale across 151+ different codebases.

So you have AI generating realistic-looking innocent commits to cover payloads that are invisible to both human reviewers and AI reviewers. That’s a new class of problem.

What this means for your team
#

If you’re pulling npm packages, installing VS Code extensions, or depending on open source libraries (so, everyone), here’s what matters:

Your current review process probably doesn’t detect this. Unless your toolchain specifically scans for Unicode PUA characters in source files, invisible payloads pass through. Snyk’s analysis recommends detecting Unicode characters by category rather than maintaining explicit character lists, which means your existing SAST tools need updating.

Pin your dependencies and audit updates. Glassworm targets existing repos with seemingly innocent version bumps and doc changes. If you auto-merge dependency updates or trust patch versions without review, you’re exposed.

Scan for eval() and dynamic execution patterns. The invisible payload still needs eval() or an equivalent to execute. Static analysis rules that flag dynamic code execution in dependency code are your best early warning.

Be suspicious of repos you haven’t verified recently. Some of the compromised repos had over 1,400 GitHub stars. Popularity doesn’t mean safety. The Wasmer WebAssembly runtime was among the targeted projects.

VS Code extensions are a vector. Glassworm hit the Open VSX marketplace too. Extensions run with significant privileges. If your team installs extensions casually, you have an unmonitored attack surface.

The bigger picture
#

I’ve written about AI security as a culture problem and building systems that don’t break under attack. Glassworm sits at the intersection of two trends I keep coming back to.

First, AI is accelerating both sides. Defenders are using AI to review code faster. Attackers are using AI to generate convincing cover commits at scale. The speed advantage isn’t one-sided.

Second, the supply chain is where the real vulnerability concentration lives. Your code might be clean. Your review process might be solid. But if one of your 400 transitive dependencies gets compromised with an invisible payload that no human or AI reviewer can see, none of that matters.

Glassworm didn’t exploit a zero-day. It didn’t find a novel vulnerability. It exploited the gap between what we look at and what we actually see. That gap is getting wider as codebases grow faster, reviews get thinner, and both sides of the attack use AI to scale.

The fix isn’t one tool or one policy. It’s treating your supply chain with the same paranoia you’d treat your own production code. Because right now, for a lot of teams, that’s the door nobody’s watching.

Seen something like Glassworm in your own supply chain? Dealing with invisible threats in your dependencies? I’d love to hear about it. Find me on X or Telegram.

Securing the AI Supply Chain: The Threat Nobody's Talking About

Mon, 13 Oct 2025 00:00:00 +0000

This is Part 3 of the “Securing Intelligence” series on AI security.

You’ve secured your prompts. You’ve implemented defensive architectures. You’ve got AI firewalls and zero-trust principles in place. You feel good about your security posture.

Then someone on your team downloads a pre-trained model from Hugging Face, copies a prompt template from a popular GitHub repo, or installs a LangChain plugin to add functionality. And just like that, you’ve potentially introduced malicious code into your AI system that bypasses every defense you carefully built.

Welcome to the AI supply chain problem: the attack vector that most organizations don’t even know exists.

This isn’t theoretical. We’re building AI systems on top of components we don’t control, can’t audit, and have no way to verify. The parallels to SolarWinds and Log4j should terrify you. But unlike those traditional supply chain attacks, AI supply chain compromises are harder to detect, easier to execute, and potentially more damaging.

Let me show you why this keeps security professionals up at night.

The Pre-Trained Model Problem
#

When you download a model from Hugging Face, PyTorch Hub, or any model repository, what are you actually getting?

A multi-gigabyte black box that could contain anything.

You’re trusting that:

The model wasn’t trained on poisoned data designed to create backdoors
The weights weren’t modified after training to introduce vulnerabilities
The model card accurately describes what the model does
The hosting platform wasn’t compromised
The original researcher had good security practices

That’s a lot of trust for something running in your production environment with access to your data.

Backdoored Models Are Real
#

Research has demonstrated that attackers can poison training data to create models with targeted backdoors. The model performs normally 99.9% of the time, but when it sees a specific trigger phrase, it executes attacker-controlled behavior.

Imagine a code completion model that generates secure code most of the time, but when it encounters a specific comment pattern in a particular library, it introduces a subtle vulnerability. Or a sentiment analysis model that correctly classifies most text, but consistently misclassifies content from specific sources.

The scary part: These backdoors can survive fine-tuning. You can train the model on your own clean data, and the backdoor remains, dormant, waiting for its trigger.

Weight Poisoning
#

Even without training data access, attackers can modify model weights directly. Researchers have shown you can inject malicious behavior into a model by modifying less than 0.1% of its parameters. Changes so small they’re nearly impossible to detect through standard testing.

You download what looks like a legitimate model. It performs well on your benchmarks. It seems fine in testing. Then in production, under specific conditions, it starts exhibiting compromised behavior.

Detection is nearly impossible without knowing exactly what you’re looking for. Traditional code analysis doesn’t work; these are numerical values, not code. You can’t just scan for vulnerabilities like you would with software dependencies.

The Prompt Template Trap
#

Your team needs to build a customer support bot. Someone finds a great prompt template on GitHub with 5,000 stars. You copy it into your system. Congratulations: you might have just deployed a prompt injection vulnerability.

Popular prompt templates are attack vectors hiding in plain sight. An attacker doesn’t need to compromise your infrastructure. They just need to contribute to popular open-source repos and wait for people to copy their code.

What malicious prompt templates can do:

Include hidden instructions that activate under specific conditions
Contain subtle biases that influence model behavior
Leak information through cleverly crafted examples
Create vulnerabilities in how they structure system vs. user content

The challenge is that prompt templates look harmless. They’re just text files. Your security team isn’t reviewing them the way they would code. But they’re executable instructions for an AI system, and they deserve the same scrutiny.

Plugin and Extension Risks
#

The LangChain ecosystem, LlamaIndex, and similar frameworks have thriving plugin ecosystems. Need your AI to search the web? There’s a plugin. Need it to access databases? There’s a plugin. Need it to integrate with Slack? There’s a plugin.

Each plugin is executable code running with your AI’s permissions. And most of them are maintained by individual developers or small teams with varying security practices.

We’re repeating the npm ecosystem’s mistakes, but with AI. Remember the event-stream compromise? A popular npm package with millions of downloads was modified to steal cryptocurrency. The maintainer handed control to someone who seemed legitimate, and that person introduced malicious code.

The AI ecosystem is even more vulnerable because:

Plugins often need broad permissions to be useful
Testing is harder (how do you verify an AI tool works correctly in all cases?)
The community is newer and security practices are immature
The potential damage is greater (AI systems often have access to sensitive data)

The Third-Party API Problem
#

Most organizations aren’t running their own LLMs. They’re using OpenAI, Anthropic, Cohere, or other hosted services. That’s a dependency too, and one you have even less control over.

What could go wrong:

Provider compromise (their infrastructure is breached)
Model updates that change behavior unexpectedly
Data retention and privacy concerns
Service outages that break your critical systems
Provider going out of business or changing terms

You’ve built your entire AI strategy on top of an API you don’t control. What’s your contingency plan if that API disappears tomorrow? Or worse, if it gets compromised and starts returning subtly malicious outputs?

The multi-provider trap: You might think using multiple providers gives you redundancy. But now you have multiple trust dependencies, different security models to evaluate, and the challenge of ensuring consistent behavior across providers.

Vector Database Poisoning
#

Here’s one most teams haven’t thought about: RAG systems are only as trustworthy as their vector databases.

If an attacker can inject malicious documents into your knowledge base, they can influence your AI’s responses. We covered this as indirect prompt injection in Part 1, but the supply chain angle is even more insidious.

Sources of contaminated vector databases:

Inherited data from previous teams or acquisitions
Documents scraped from untrusted sources
“Clean” datasets downloaded from research repositories
Backup restores from compromised snapshots
Insider threats from contractors with data access

Unlike prompt injection, which happens at query time, vector database poisoning is persistent. It sits in your knowledge base, waiting to be retrieved and used to influence responses.

The detection problem: How do you audit thousands or millions of embedded documents for malicious content? Traditional scanning doesn’t work; the malicious instructions might be perfectly valid text that only becomes dangerous when retrieved as context for an LLM.

The Open-Source Dependency Chain
#

Modern AI systems rely on dozens of dependencies: LangChain, LlamaIndex, HuggingFace Transformers, vector databases, embedding models, and countless utility libraries.

Each dependency is a potential compromise point. And AI dependencies are particularly dangerous because:

They often have broad permissions (file system access, network access, execution rights)
Updates are frequent and fast-moving (breaking changes are common)
Security audits are rare (everyone’s moving too fast)
The transitive dependency chain is deep (your direct dependencies have dependencies)

We learned this lesson with traditional software supply chain attacks. But AI teams are making the same mistakes because the technology is new and everyone’s in a rush to ship.

The AI Supply Chain Risk Landscape
#

Here’s a practical view of common AI components and their risk profiles:

Component Type	Examples	Risk Level	Primary Concerns	Verification Difficulty
Pre-trained Models	Hugging Face, PyTorch Hub	High	Backdoors, poisoned weights, malicious behavior	Very Difficult
Prompt Templates	GitHub repos, blogs	Medium	Hidden instructions, injection vectors	Moderate
Plugins/Extensions	LangChain tools, custom agents	High	Broad permissions, code execution	Moderate
Vector Databases	Pinecone, Weaviate, Chroma	Medium	Data poisoning, access control	Difficult
Third-party APIs	OpenAI, Anthropic, Cohere	Medium	Provider compromise, data privacy	Very Difficult
Training Datasets	Open datasets, scraped data	High	Poisoned data, bias injection	Very Difficult
Embedding Models	Sentence transformers, OpenAI	Medium	Behavior manipulation	Difficult
Framework Dependencies	LangChain, LlamaIndex	Medium	Transitive dependencies, updates	Moderate

Use this as a starting point for your supply chain risk assessment. Not all components need the same level of scrutiny; focus your efforts on high-risk items first.

What You Can Actually Do
#

This all sounds dire. And honestly, it is. But giving up isn’t an option. Here’s what responsible AI teams are doing:

Verify Provenance
#

Know where your models, data, and tools come from. Maintain an inventory:

Which models are you using, and who trained them?
What datasets were used in training?
Which prompt templates came from external sources?
What plugins and extensions are installed?

Treat AI components like you treat software dependencies. You wouldn’t npm install random packages without reviewing them. Don’t download random models without scrutiny.

Implement Model Validation
#

Before deploying a model, test it aggressively:

Benchmark on diverse datasets, not just the happy path
Test for bias and unexpected behavior patterns
Look for anomalies in edge cases
Compare behavior to known-good baselines

This won’t catch sophisticated backdoors, but it will catch sloppy attacks and obvious compromises.

Sandbox External Components
#

Run untrusted models and plugins in sandboxed environments with limited permissions. If you’re testing a new model, don’t give it production database access right away.

Air-gapped evaluation environments are your friend. Test models on representative but isolated data before promoting them to production.

Monitor for Anomalies
#

Establish baselines for normal behavior and alert on deviations:

Unexpected data access patterns
Output characteristics that don’t match training
Performance degradation or latency changes
Unusual API call patterns from plugins

The goal isn’t to prevent compromise; it’s to detect it quickly and respond before damage spreads.

Pin Versions and Review Updates
#

Don’t auto-update AI dependencies. Pin specific versions, test updates in staging, and review changelogs before deploying to production.

This seems obvious, but I’ve seen teams that carefully version-control their application code while their AI dependencies update automatically every time they deploy. That’s a recipe for production surprises.

Build Redundancy and Fallbacks
#

Don’t bet your entire system on a single model or provider. Have fallback options:

Alternative models for critical paths
Cached responses for common queries
Graceful degradation when AI components fail
Manual processes as last resorts

The goal is resilience, not just security. But resilience is security: if your AI system being compromised doesn’t take down your entire business, you’re in a better position.

The Industry Needs to Do Better
#

Individual teams can’t solve this alone. We need industry-level changes:

Model signing and verification - Cryptographic signatures that prove a model came from a specific source and wasn’t tampered with. This exists for software packages; we need it for AI components.

Standardized security audits - Third-party audits of popular models, frameworks, and tools. Right now, security review of AI components is ad-hoc at best.

Vulnerability disclosure processes - When someone finds a backdoor in a popular model, where do they report it? We need CVE equivalents for AI components.

Transparency requirements - Training data provenance, fine-tuning history, and known limitations should be documented standards, not optional extras.

Supply chain attestation - Ways to prove that your AI system only uses verified, audited components. This is critical for regulated industries.

Some of this is starting to happen. The ML Commons, NIST, and various industry groups are working on standards. But adoption is slow, and most organizations are moving too fast to wait for perfect solutions.

The Uncomfortable Truth
#

The AI supply chain is fundamentally insecure, and it’s going to stay that way for a while. We’re building critical systems on top of components we can’t fully trust or verify.

This is the cost of moving fast. The organizations that succeed will be the ones that acknowledge the risk and build accordingly: with monitoring, redundancy, and incident response plans that assume compromise.

The ones that fail will be the ones that discover their critical AI system has been running compromised code for six months, and they have no way to know what damage has been done.

What Comes Next
#

In the final part of this series, we’re going to zoom out from technical controls and talk about the hardest part of AI security: culture.

Because here’s the thing: you can implement every technical control in this series (prompt isolation, AI firewalls, supply chain verification, monitoring) and still get breached if your organization’s culture doesn’t take AI security seriously.

The final piece isn’t about tools or architecture. It’s about building teams that think about security by default, that balance innovation with responsibility, and that can respond effectively when things go wrong. Because in AI security, it’s not if things go wrong; it’s when.

Supply Chain · PiniShv

Glassworm Is Back. Your Code Review Won't Catch It.

How it works #

Why this is harder to catch than you think #

What this means for your team #

The bigger picture #

Securing the AI Supply Chain: The Threat Nobody's Talking About

The Pre-Trained Model Problem #

Backdoored Models Are Real #

Weight Poisoning #

The Prompt Template Trap #

Plugin and Extension Risks #

The Third-Party API Problem #

Vector Database Poisoning #

The Open-Source Dependency Chain #

The AI Supply Chain Risk Landscape #

What You Can Actually Do #

Verify Provenance #

Implement Model Validation #

Sandbox External Components #

Monitor for Anomalies #

Pin Versions and Review Updates #

Build Redundancy and Fallbacks #

The Industry Needs to Do Better #

The Uncomfortable Truth #

What Comes Next #