InvisibleJS Hides Executable ES Modules in Empty Files Using Zero-Width Steganography

A groundbreaking proof-of-concept tool called InvisibleJS has surfaced on GitHub, revealing a sophisticated method for concealing JavaScript source code from human detection while maintaining full executability.

Created by developer oscarmine, the tool demonstrates advanced steganographic techniques that transform visible code into invisible characters, raising significant security concerns for the development community.

How the Steganography Works

InvisibleJS employs Unicode steganography to encode JavaScript payloads into zero-width characters that render as blank files to the human eye.

The mechanism converts source code into 8-bit binary strings and maps each bit to a specific Unicode character: Zero Width Space (U+200B) represents zeros, while Zero Width Non-Joiner (U+200C) represents ones.

The encoded payload includes a bootstrap loader that automatically decodes and executes the hidden code at runtime, making the technique seamlessly functional across different JavaScript environments.

The tool offers two versions optimized for different JavaScript contexts, each addressing specific execution requirements:

Feature	Version 1 (eval)	Version 2 (import)
Invisibility	100%	100%
CommonJS Support	Native	Limited
ESM Support	No	Full Support
Top-Level Await	No	Yes
Execution Method	Synchronous	Asynchronous
Decoder Length	Short	Long

Version 1 targets traditional CommonJS environments and legacy browsers, using synchronous eval(). It naturally handles Node.js variables, including require, _dirname, and module. exports, ensuring compatibility with older systems.

Version 2 supports modern ES Modules through dynamic await import() with data URI schemes. This version enables top-level import statements, export keywords, and top-level await functionality, though it requires full ES Module support.

The InvisibleJS technique presents substantial security risks. Files encoded with the tool appear empty on visual inspection, potentially concealing malicious payloads in supply-chain attacks or code-injection scenarios.

The dramatic file-size expansion, approximately 24 times the original, due to UTF-8 encoding, provides one potential detection indicator, though automated tools may miss this during rapid security reviews.

Security researchers caution that while InvisibleJS demonstrates educational value in understanding steganographic capabilities, the technique could be weaponized to bypass manual code inspections and security reviews.

Organizations should implement automated code analysis tools that detect zero-width character encoding schemes.

Additionally, security scanners should be configured to flag anomalous file-size variations and to analyze suspicious Unicode character patterns in source repositories.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.