Supply-chain attack using invisible code hits GitHub and other repositories

This supply-chain attack using invisible code is one of the most stealthy compromises ever seen on GitHub. The attackers embedded malicious payloads inside zero-width Unicode characters, making the code appear harmless to both automated scanners and human reviewers. Over 30 popular open-source repositories were infiltrated before detection. This method is 10 times harder to spot than the average supply-chain attack because it leaves no visible traces in diffs or commit logs. Unlike typical malware that relies on obfuscated strings or encoded functions, this approach hides entire scripts within invisible characters, evading even advanced static analysis tools. The attack underscores a dangerous evolution: as defenses improve, adversaries are turning to literally invisible tactics, and developers must now audit their dependencies for hidden threats that standard CI pipelines cannot catch.