JavaScript Backdoor Uses Invisible Characters to Evade Code Review
Security researchers at Certitude Consulting have demonstrated a nearly undetectable backdoor technique that exploits invisible Unicode characters to slip malicious code past even the most meticulous code reviews.
Wolfgang Ettlinger, the researcher behind the discovery, notes that the exploit is designed to avoid all common detection methods—it triggers no linting errors and leaves syntax highlighting entirely intact. The malicious code blends in so seamlessly that most reviewers would never notice it without deliberate, character-by-character inspection.
The attack leverages a specific Unicode trick that makes the backdoor effectively invisible while still being fully functional. When executed, the hidden code passes both hardcoded commands and user-supplied parameters to the exec function, which then runs them as operating system commands—granting the attacker arbitrary command execution on the target machine.
Ettlinger suggests that the Unicode specification itself may need revision to counter this threat:
The Cambridge team proposes restricting Bidi Unicode characters. As we have shown, homoglyph attacks and invisible characters can pose a threat as well.
