Invisible Character Detector

A VS Code extension that detects and highlights invisible Unicode characters commonly used in malware obfuscation attacks.

Background

Recent attacks like GlassWorm have used invisible Unicode characters to hide malicious code in VS Code extensions and other software. This extension helps developers identify these characters before they cause security issues.

Supported Attack Vectors

• GlassWorm - Self-propagating worm using invisible code
• PAC file attacks - Proxy Auto-Configuration malware obfuscation
• Supply chain attacks - Invisible characters hiding malicious payloads

What It Detects

This extension monitors for 14 different invisible Unicode characters:

• Hangul Filler (U+3164)
• Halfwidth Hangul Filler (U+FFA0)
• Zero Width Space (U+200B)
• Zero Width Non-Joiner (U+200C)
• Zero Width Joiner (U+200D)
• Left-to-Right Mark (U+200E)
• Right-to-Left Mark (U+200F)
• Word Joiner (U+2060)
• Function Application (U+2061)
• Invisible Times (U+2062)
• Invisible Separator (U+2063)
• Invisible Plus (U+2064)
• Zero Width No-Break Space (U+FEFF)
• Mongolian Vowel Separator (U+180E)

Features

Real-time Detection

Automatically scans open files and highlights invisible characters as you type.

Critical Pattern Detection

When multiple consecutive invisible characters are detected (>5), the extension shows a critical alert. This pattern is commonly used in GlassWorm-style attacks.

Visual Indicators

• Orange highlights with diamond markers for single invisible characters
• Red highlights with square markers for critical patterns
• Warning/error markers in the editor gutter
• Integration with the Problems panel

Status Bar Integration

Displays the count of invisible characters in the current file.

Detailed Information

Hover over highlighted characters to see:

• Character name and Unicode code point
• Position in the file
• Whether it's part of a critical pattern
• Information about related attack vectors

Decoder

Automatically detects and decodes binary-encoded payloads hidden in invisible character sequences. Supports multiple encoding schemes including Hangul Filler and zero-width character encodings.

Usage

1. Install the extension
2. Open any file in VS Code
3. The extension automatically activates and scans for invisible characters
4. View detections in:
   • Editor (highlighted with colors)
   • Problems panel
   • Status bar on the bottom right corner

Commands

• Security: Show Invisible Characters - Display a summary
• Security: Decode Invisible Characters - Decode binary-encoded payloads

Access via Command Palette (Ctrl+Shift+P / Cmd+Shift+P)

Example Attack Pattern

GlassWorm use this technique to hide malicious code:

// What developers see:
function normalCode() {
    console.log("Hello");
}


// Empty lines above? Actually invisible characters hiding:
eval(avar("somethingsomething"))

This extension makes these invisible characters visible and tries to decode it if you want it to.

Development

This extension was created thanks to John Hammond that published a video about Glassworm on December 5th 2025, that made me look into this method and try and develop my first extension.

References

• GlassWorm Analysis by Koi Security
• Invisible Obfuscation in PAC Attacks
• Invisible.js Encoder
• So malware is invisible now lol by John Hammond

License

GNU

Contributing

Contributions are welcome. Please submit issues or pull requests, however i might be a bit slow on approving them as i'm not really experienced in this kind of things

Security Notice

This extension helps detect potential malware obfuscation techniques. This extension should never be used as a single part of your security strategy, please use more tools and don't depend on a single extension for this kind of things. Tanuki Software offers this extension for free under your own responsability, if you're unsure of our code, you can always check it, and if you find something that is not right, please mark the commit that added this code fragment and report the issue, i'll look into it as soon as possible.

Always:

• Review code from untrusted sources carefully
• Keep your extensions updated
• Use official extension marketplaces
• Report suspicious extensions to platform maintainers

Features

Invisible Characters Highlighted in Code

Status Bar Indicator

Decoder Output

Configuration Options

Requirements

• Visual Studio Code version 1.106.1 or higher
• No additional dependencies required

Extension Settings

This extension contributes the following commands:

• glassworm-highlighter.showInvisibleChars: Display a summary of invisible characters in the current file
• glassworm-highlighter.decodeInvisibleChars: Attempt to decode binary-encoded payloads hidden in invisible character sequences. this might not work 100% of the times it's run, if you have any idea on how to improve this, please let me know or submit a commit c:

The extension automatically activates when VS Code starts and monitors all open files.

Release Notes

1.0.1

• Added extension icon for better visibility in the marketplace

1.0.0

Initial release of Invisible Character Detector.

Features:

• Real-time detection of 14 invisible Unicode characters
• Visual highlighting with orange (warning) and red (critical) markers
• Integration with VS Code Problems panel
• Status bar indicator showing character count
• Hover tooltips with detailed character information
• Binary decoder supporting multiple encoding schemes
• Auto-detection of Hangul Filler and zero-width character encodings
• Base64 decoding support for layered obfuscation
• Critical pattern detection for consecutive invisible characters

Detected Characters:

• Hangul Filler (U+3164)
• Halfwidth Hangul Filler (U+FFA0)
• Zero Width Space (U+200B)
• Zero Width Non-Joiner (U+200C)
• Zero Width Joiner (U+200D)
• Left-to-Right Mark (U+200E)
• Right-to-Left Mark (U+200F)
• Word Joiner (U+2060)
• Function Application (U+2061)
• Invisible Times (U+2062)
• Invisible Separator (U+2063)
• Invisible Plus (U+2064)
• Zero Width No-Break Space (U+FEFF)
• Mongolian Vowel Separator (U+180E)