Down the Rabbit Hole of Unicode Obfuscation

Down the Rabbit Hole of Unicode Obfuscation | Veracode

By Natalie Tischler

The rabbit–hole went straight on like a tunnel for some way, and then dipped suddenly down, so suddenly that Alice had not a moment to think about stopping herself before she found herself falling down a very deep well.

– Alice’s Adventures in Wonderland by Lewis Carroll, Ch. 1

Introduction

In the ever-vigilant effort to secure the open-source ecosystem, Veracode’s continuous monitoring systems recently flagged a pair of npm malware packages— solders and @mediawave/lib . The malicious behavior, however, is not at all obvious at first because of a layer of unusual Unicode obfuscation that caught our attention. Our investigation focused on the solder…