unicode-security

ESLint rules for detecting Trojan Source (bidi Unicode) attacks in JS/TS

A single invisible Unicode character can flip how code executes versus how it reads on screen. Here's how to configure ESLint to catch it.