SG-048: Variation Selector / Combining Mark Anomaly

Severity: MEDIUM

High density of VS or combining-mark codepoints, or GlassWorm decoder fingerprint

Fires when

• More than 5% of the file's characters are Variation Selectors or combining marks (or more than 20 such characters), excluding legitimate use in scripts like Arabic, Hebrew, Devanagari, or CJK
• The source code contains the GlassWorm decoder fingerprint: hex range checks against 0xFE00-0xFE0F or 0xE0100-0xE01EF combined with codePointAt

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode
• https://paulbutler.org/2025/smuggling-arbitrary-data-through-an-emoji/