Moshe-ship

GitHub · Repository owner · Source ID 59829952
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

Moshe-ship/bidi-guard

Repository PoC5Created 2026-03-21ScannerCVE-2021-4257418 files

1.1 MiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python tool named 'bidi-guard' that scans source code files for invisible bidirectional Unicode characters associated with CVE-2021-42574 (Trojan Source). It detects and reports the presence of these characters but does not exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The reviewed source files (README.md, bidi_guard/scanner.py, pyproject.toml) implement a payload withheld for CVE-2021-42574. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code reads files, scans for specific Unicode code points, and reports findings. It does not execute downloaded content, establish persistence, exfiltrate data, or perform any unrelated harmful actions.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwaresource code files
Attack typesTrojan Source
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code's primary operation is to detect and report the presence of dangerous Unicode bidirectional characters in source files. It does not contain any code that exploits the vulnerability (e.g., crafting or injecting malicious bidi sequences to alter program logic). The README explicitly describes it as a scanner ('Scan code for invisible bidirectional Unicode characters') and the scanner.py module implements detection logic.

README.md:5bidi_guard/scanner.py:1bidi_guard/scanner.py:150-200

Requirements

  • Python 3.9+ environment with bidi-guard installedREADME.md:35pyproject.toml:5
  • Target source code files to scanREADME.md:42-45

Observed behavior

  • Scans files for 16 specific Unicode bidirectional control characters and reports their location, name, and severityREADME.md:48README.md:93-112bidi_guard/scanner.py:150-200
  • Provides a 'ci' command that exits non-zero if dangerous characters are found, suitable for CI/CD pipelinesREADME.md:55README.md:76
  • Offers a 'fix' command to remove all bidi characters from filesREADME.md:56
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Functionality
Payload withheldThe artifact scans source files for invisible bidirectional Unicode characters to prevent Trojan Source attacks (CVE-2021-42574).README.md:5bidi_guard/scanner.py:150-200
Dependency
Payload withheldThe only declared dependency is 'rich', a common Python library for terminal formatting, which is consistent with the scanner's CLI functionality.pyproject.toml:15-17
Review boundaries

What the analysis did not establish

  • Only 3 of 18 files in the repository were provided as text; the remaining 15 files (including potential CLI, character definitions, and tests) were omitted, limiting full behavioral analysis.
  • The evidence includes 2 non-text media files (1,119,238 bytes) that were not analyzed, which could contain additional context.
  • The analysis is based solely on static source code review; the tool was not executed to confirm runtime behavior.
  • Only 3 of 18 files in the repository were provided as text evidence. The remaining 15 files (13 text, 2 non-text) were omitted and not analyzed.
  • Binary files were flagged as metadata-only and not inspected for embedded payloads.
  • The review is limited to static analysis of the provided source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.