nickboucher/trojan-source resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1285 stars · 266 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The reference repository for the Trojan Source attack (CVE-2021-42574), which uses Unicode bidirectional control characters to make source code visually display logic different from what the compiler actually executes. It bundles proofs-of-concept across a dozen languages (C, C++, Java, Rust, Go, Python, Solidity, and more), compiler-level defense guidance, and the companion research paper and website.

Use cases

• learn how unicode bidi control characters can hide vulnerabilities in source code
• test whether a compiler or interpreter is vulnerable to trojan source encoding attacks
• understand supply chain attacks that deceive human code reviewers
• find proofs of concept for CVE-2021-42574 in specific languages
• study mitigations for invisible source code vulnerabilities in editors, repos, and build pipelines
• research academic work on adversarial source code encoding

When to choose

• You are studying or teaching how Trojan Source / bidi reordering attacks on source code work
• You want per-language proofs of concept to verify whether toolchains, editors, or CI pipelines render and compile such code safely
• You are researching supply-chain attack techniques or designing compiler-level and code-review defenses

When to avoid

• You need a production-ready scanner that continuously detects malicious Unicode in your repositories rather than research artifacts
• You want an actively maintained security tool with new features instead of a completed research publication
• You need turnkey mitigation tooling for a specific language ecosystem out of the box

Facets

learning-resource · maturity stable

security security programming-languages developer-tools cross-platform c cpp python rust go trojan-source unicode bidi-characters supply-chain-security vulnerability-research proof-of-concept cve-2021-42574 code-review compiler-security academic-research homoglyph-attacks nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nickboucher/trojan-source")