nicetry

Strips Unicode Private Use Area (PUA) characters from files.

Why

In March 2026, the Glassworm supply chain campaign embedded malicious payloads inside invisible Unicode PUA characters hidden in source files, packages, and VS Code extensions — characters that don't render in editors, terminals, or code review interfaces, and that grep, linters, and AI review tools miss entirely.

Full write-up: Glassworm Is Back. Your Code Review Won't Catch It.

nicetry gives you a simple, auditable way to scrub these characters from any file before you trust or commit it.

What it does

1. Reads the file and verifies it is valid UTF-8. Exits with an error if not.
2. Strips every character in the three Unicode Private Use Areas:
   • BMP: U+E000 – U+F8FF
   • Supplementary PUA-A: U+F0000 – U+FFFFF
   • Supplementary PUA-B: U+100000 – U+10FFFF
3. Writes the cleaned content to stdout.

Install

Requires Go 1.21+.

go install codeberg.org/canoozie/nicetry@latest

Usage

# Print cleaned output
nicetry suspicious_file.js

# Overwrite in place
nicetry suspicious_file.js > cleaned.js && mv cleaned.js suspicious_file.js

# Scan a dependency before installing
curl -s https://example.com/package.js | nicetry /dev/stdin

Exit codes:

• 0 — success (output written to stdout)
• 1 — file could not be read, or is not valid UTF-8

License

MIT