Introducing Code Corgi: Invisible Threat Detection for Every Pull Request
An archived introduction to Code Corgi and invisible threats in source code.
The SolarWinds attack used legitimate build infrastructure. The XZ Utils backdoor hid inside compression library commits for two years. The Log4Shell ecosystem spawned dozens of typosquatting packages, some with homoglyph names indistinguishable from the real thing at a glance.
These attacks share a common thread: they exploit the gap between what code looks like and what it does.
The Problem We’re Solving
Modern code review is a human process applied to an inhuman volume of changes. A single enterprise engineering org might review thousands of pull requests per week. Each one could contain:
- A zero-width non-joiner character (U+200C) embedded inside an identifier
- A Cyrillic
а(U+0430) substituted for a Latinain a package name - A base64-encoded payload tucked inside a config value
- A dynamic
require()call that resolves at runtime based on environment variables
None of these are visible in a standard code review. All of them have been used in real-world attacks.
Review invisible changes
Review Unicode codepoints in identifiers and strings. Compare lookalike characters with the intended package names. Inspect dynamic imports, encoded commands, and workspace configuration before running unfamiliar code.
Archive note
This article introduced Code Corgi, a parked code-scanning project. It remains here as historical context. SURADAR focuses on runtime assurance for AI agents.