MAL-TROJAN Trojan-Source Unicode Attacks
A trojan-source attack hides malice in plain sight by inserting invisible Unicode control characters, so the code a human reviews and a diff renders differs from the code the compiler or interpreter actually executes. Because the trick lives in bytes no reviewer can see, human diff review cannot catch it and a byte-level scan can.
What Vulkro detects
Three classes, one finding per file per class.
MAL-TROJAN-001 (High) fires on a bidirectional control character (U+202A-U+202E, U+2066-U+2069, U+061C) anywhere in a source file. These reorder how text is displayed without changing byte order, which is the mechanism behind the commenting-out and stretched-string attacks. Legitimate source essentially never needs an embedded BiDi override, so presence alone grades High.
MAL-TROJAN-002 (Medium) fires on a byte-order mark (U+FEFF) somewhere other than byte offset 0. A leading BOM is a benign encoding marker; a mid-file one is an invisible character with no purpose in code.
MAL-TROJAN-003 (Medium, review-only shape) fires on a zero-width character (U+200B, U+200C, U+200D) sitting directly against an ASCII identifier character, which can split or homoglyph an identifier so two visually identical names bind to different symbols. It stays Medium because emoji ZWJ sequences and some internationalised text use these legitimately.
The detector walks source files under the scan root (skipping node_modules, .git, and common vendored or build directories) and reports the first offending line per class. It is deterministic and evasion-resistant, because the attack is the presence of these codepoints and there is nothing to obfuscate around. It still does not tell you the intent behind the character.
Remediation. Open the reported line in an editor with invisible-character rendering on and decide whether the codepoint belongs. Strip BiDi overrides and stray zero-width characters from source, and add a CI check that rejects them, so a reviewer never has to trust that a diff renders what it runs.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.