Unicode Tricks Let Malicious Python Code Bypass Code Review
A subtle but powerful class of attacks allows source code to pass human review while executing completely different logic. The root cause lies in the gap between how fonts render Unicode characters and how the Python interpreter reads the underlying bytes.
The first technique uses homoglyphs. An attacker can declare is_admin = False followed by a second assignment that looks identical but actually uses the Ukrainian letter і (U+0456) instead of Latin i (U+0069). The review sees a single variable being set to True, yet the interpreter creates two separate identifiers. The same substitution works for function names such as validate_token, causing the wrong implementation to run in production.
Python normalizes identifiers with NFKC, which collapses some visually similar characters but leaves Cyrillic letters untouched. Consequently, the attack remains effective in real codebases.
The second technique relies on bidirectional override characters (RIGHT-TO-LEFT OVERRIDE U+202E and related controls). These characters are required for Arabic and Hebrew text, yet they also allow an attacker to reorder source lines visually. A comment that appears harmless on screen can actually contain executable statements once the compiler ignores the display order. The technique became widely known in 2021 as the Trojan Source attack and affects nearly every mainstream programming language.
The third, simpler method inserts zero-width characters (U+200B, U+2060, etc.) inside string literals. The string 'password' has length nine and will never equal the expected value, yet the difference is invisible to the naked eye and defeats both manual inspection and simple grep searches.
A compact detection script walks the source with Python’s tokenize module and separately scans for bidirectional and zero-width characters. Checking only identifier tokens prevents false positives from comments and string data. The same logic is available as built-in rules in ruff and flake8, while gitleaks can block commits containing the dangerous characters.
Teams are advised to run the check across existing repositories, integrate it into CI pipelines, and treat any intentional insertion of these characters as a serious red flag during incident review.
Related articles
Malicious Code Injected into LiteLLM Open Source AI Package via Supply Chain Attack
The open-source generative AI tool LiteLLM had malicious code inserted into its official distribution packages, enabling credential theft and remote code execution. The compromise affected version 1.107.0 released on October 21, 2026, and was delivered through legitimate channels in a classic software supply chain attack. Seven malicious wheel files were uploaded to PyPI, while official container images on Docker Hub and GitHub Container Registry were also tainted. Security firm JFrog discovered that the malware steals a wide range of secrets including cloud credentials, SSH private keys, browser-stored passwords, development tokens, and AI service API keys from LiteLLM's database. The code also supports execution of externally fetched payloads and abuses Python's startup mechanisms to run even when the application itself is not loaded. This marks the second supply chain incident involving the project in 2026, following a separate event in March.
GhostAction Campaign Compromises 790 GitHub Repositories via Malicious Workflows
Researchers from OpenSourceMalware have identified 790 publicly accessible GitHub repositories containing malicious workflows planted by the GhostAction campaign as of October 9. The campaign abuses trusted maintainer accounts to inject workflows that automatically exfiltrate secrets including AWS access keys and tokens for GitHub, GitLab, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter. Earlier counts by GitGuardian recorded 772 repositories between August 31 and September 30, though the datasets differ and are not cumulative. A separate wave on October 8 impacted 346 repositories linked to two maintainer accounts, including a project belonging to Uber. The malicious workflow runs on code pushes or manual triggers, scans repository files and full Git history for credentials, and sends findings in plaintext to attacker infrastructure. Removing the workflow file does not mitigate exposure, as successful executions already leak credentials and old commits may still contain secrets.
SberTech Launches Platform V Orchestrator for Security Services to Scan Software Before Corporate Deployment
SberTech has announced the launch of a new direction focused on analyzing the security of software prior to its integration into corporate infrastructures. The initiative is built around the company's own Laboratory for Software Verification and the technological platform Platform V Orchestrator for Security Services. This platform combines components for working with both built-in and external analysis tools, enabling checks of digital artifacts, control over software composition and changes, and detection of vulnerabilities, hidden threats, and defects in source code and repositories. SberTech aims to replace fragmented checks and manual result processing with a single managed process, allowing scaled verification without proportional team growth. The move responds to the adoption of hundreds of products from various vendors, widespread use of open-source components, and rising attacks on software supply chains. Primary customers include banks, industrial enterprises, telecom operators, energy companies, and the public sector. The solution is offered as a standalone product that supports on-premises deployment and operation in isolated environments such as private clouds and dedicated data processing contours.
NEC Subcontractor Suffers Cyber Attack Leading to Customer System Disruptions and Personal Data Leak
NEC disclosed that a subcontractor handling system development and maintenance was compromised in a cyber attack during late September 2026. Attackers stole legitimate account credentials and used them to access multiple customer environments from the subcontractor's systems. The intrusion resulted in server files being encrypted, rendering customer systems inoperable. Additional files containing personal information and system details were exfiltrated from a shared cloud storage platform used for coordination between NEC, the subcontractor, and customers. Affected customers have been notified individually, with further details on compromised personal data to be provided as they become available. The incident highlights risks associated with third-party vendor access in IT supply chains.