Gallery

Well-known obfuscation techniques and what disclude 4.3.0 reports on each. Unlike most signals in package scans, these are the real thing: each file hides what it does on purpose.

• Trojan Source

  A right-to-left override makes a comment read like code.

  trojan_source.py · 1 critical · 0 warn · 0 info

• GlassWorm

  A payload in invisible variation selectors, decoded and run.

  glassworm.js · 2 critical · 0 warn · 0 info

• Homoglyph identifier

  Cyrillic letters in a name that reads as plain English.

  homoglyph.py · 0 critical · 4 warn · 2 info

• Fake job interview

  An "API key" that decodes to a URL, fetched on startup.

  recruiter.js · 0 critical · 2 warn · 0 info

• Reversed loader

  Base64 of zlib, stored backwards, inflated and run.

  reversed_loader.js · 1 critical · 4 warn · 0 info

• Bash-Obfuscate

  A script cut into fragments, reassembled by eval.

  bash_obfuscate.sh · 1 critical · 0 warn · 0 info

• WhatsApp's hidden notes for AI

  Instructions for a chatbot, in a help page's data that never renders.

  whatsapp_llm_include.html · 0 critical · 2 warn · 0 info

• IOCCC 2024: Prize in murky waters

  A recipe hidden in invisible Unicode tag characters.

  ioccc_2024_cable2.c · 1 critical · 2 warn · 3 info

• IOCCC 2020: Best of Show

  Tic-tac-toe computed by a single printf.

  ioccc_2020_carlini.c · 1 critical · 2 warn · 1 info

• IOCCC 2024: Prize in tray planting

  A bonsai tree generator, its data stored as doubles.

  ioccc_2024_codemeow.c · 1 critical · 1 warn · 1 info