pre-commit-glassworm

A pre-commit hook that detects GlassWorm‑style supply-chain attacks: invisible Unicode characters, variation selectors, Trojan Source (CVE-2021-42574), and zero-width characters that can hide malicious code from reviewers and many automated scanners.

What it catches

• Variation Selectors (U+FE00–U+FE0F) – GlassWorm primary technique
• Variation Selectors Supplement (U+E0100–U+E01EF)
• Bidi control (U+202A–202E, U+2066–2069) – Trojan Source
• Zero-width (U+200B–200F, U+2060–2064, U+180E)
• BOM mid-file (U+FEFF) – valid at file start, flagged elsewhere
• Replacement character (U+FFFD)
• Other format characters (Cf category)

Installation

As a pre-commit hook

Add to .pre-commit-config.yaml:

repos:
  - repo: https://github.com/solaegis/pre-commit-glassworm
    rev: v0.1.0  # pin to tag for reproducible installs
    hooks:
      - id: glassworm

Then:

pre-commit install

Using glassworm with prek

If you prefer using prek instead of pre-commit, you can define a prek.toml file:

[[repos]]
repo = "https://github.com/solaegis/pre-commit-glassworm"
rev = "v0.1.0"  # pin to tag for reproducible installs
hooks = [{ id = "glassworm" }]

Then run prek install. Your existing .pre-commit-config.yaml also works with prek unchanged.

Standalone

uv add pre-commit-glassworm
# or: pip install pre-commit-glassworm

glassworm path/to/file.py path/to/other.js
glassworm src/                              # scan directory recursively
cat file.py | glassworm                     # read from stdin

Configuration

Optional config in pyproject.toml or .glassworm.toml:

[tool.glassworm]
severity = "error"   # "error" | "warning"

• severity=error – exit 1 on findings (blocks commit)
• severity=warning – exit 0, prints warning (allows commit)

CLI options

glassworm [OPTIONS] [FILES...]

JSON output

For CI/SARIF integration:

glassworm --format json src/

Returns a JSON array of finding objects with path, line, column, codepoint, hex_repr, name, category, and unicode_category.

CI integration

pre-commit run --all-files

Commitizen and version bump

This project uses Commitizen for Conventional Commits:

pre-commit install --hook-type commit-msg

Version bump via Taskfile:

task bump          # infer from conventional commits since last tag
task bump:patch    # force patch (0.0.X)
task bump:minor    # force minor (0.X.0)
task bump:major    # force major (X.0.0)

Publishing to PyPI

# 1. Create .env with your PyPI token:
#    UV_PUBLISH_TOKEN=pypi-...

# 2. Or copy from example:
cp .env.example .env
#    Edit .env and add your token

# 3. Build and publish
task publish

.env is gitignored. task publish loads it automatically.

License

MIT – see LICENSE.