# nickboucher/trojan-source

Trojan Source: Invisible Vulnerabilities

Repository: https://github.com/nickboucher/trojan-source
Canonical: https://ross.abutalabs.com/products/trojan-source
Homepage: https://trojansource.codes
Language: SCSS
License: MIT
License Family: permissive
Last push: 2023-04-26T08:22:53+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1890, "days_push": 1225, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1285, forks 266 (observed 2026-08-28T04:04:14.700573+00:00)

## What it is
The reference repository for the Trojan Source attack (CVE-2021-42574), which uses Unicode bidirectional control characters to make source code visually display logic different from what the compiler actually executes. It bundles proofs-of-concept across a dozen languages (C, C++, Java, Rust, Go, Python, Solidity, and more), compiler-level defense guidance, and the companion research paper and website.

## Use cases
- learn how unicode bidi control characters can hide vulnerabilities in source code
- test whether a compiler or interpreter is vulnerable to trojan source encoding attacks
- understand supply chain attacks that deceive human code reviewers
- find proofs of concept for CVE-2021-42574 in specific languages
- study mitigations for invisible source code vulnerabilities in editors, repos, and build pipelines
- research academic work on adversarial source code encoding

## When to choose
- You are studying or teaching how Trojan Source / bidi reordering attacks on source code work
- You want per-language proofs of concept to verify whether toolchains, editors, or CI pipelines render and compile such code safely
- You are researching supply-chain attack techniques or designing compiler-level and code-review defenses

## When to avoid
- You need a production-ready scanner that continuously detects malicious Unicode in your repositories rather than research artifacts
- You want an actively maintained security tool with new features instead of a completed research publication
- You need turnkey mitigation tooling for a specific language ecosystem out of the box

## Facets
- artifact type: learning-resource
- maturity: stable
- function: security
- domain: security, programming-languages, developer-tools
- platform: cross-platform, c, cpp, python, rust, go
- tags: trojan-source, unicode, bidi-characters, supply-chain-security, vulnerability-research, proof-of-concept, cve-2021-42574, code-review, compiler-security, academic-research, homoglyph-attacks, nodejs

## Member repositories
- nickboucher/trojan-source (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:14.700573+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:56:40.698822+00:00, confidence not recorded.
  - readme: https://github.com/nickboucher/trojan-source (fetched 2026-08-28T04:04:14.700573+00:00, sha 34567483903e)
  - homepage: https://trojansource.codes (fetched 2026-08-29T12:12:21.622460+00:00, sha 931f71c9855e)
- Data as of 2026-08-30T08:39:29.467469+00:00.