Trojan Source is a source-code deception technique disclosed in 2021 by Nicholas Boucher and Ross Anderson. This historical article explains the difference between what a reviewer sees and the logical sequence of characters processed by a compiler or interpreter.
How visual deception arises
Unicode bidirectional control characters can change the displayed order of text without changing its underlying logical order. In a vulnerable workflow, code can therefore look different to a human reviewer from the instructions that are actually processed. A related technique uses visually similar characters from different scripts.
This is not a claim that every modern compiler or programming language is currently vulnerable. Exposure depends on the language, toolchain, editor, repository interface and their versions and checks. The research tracks the bidirectional technique as CVE-2021-42574 and the homoglyph variant as CVE-2021-42694.
Why review and supply chains matter
A misleading change can pass a visual review and enter a shared dependency. That possibility does not mean a particular package contains malicious code: a finding needs the actual characters, semantics and affected build process to be examined.
Defensive checks
Use maintained compilers, editors and repository tools. Enable appropriate warnings or checks for suspicious bidirectional controls and confusable identifiers, inspect flagged changes and test the resulting behaviour. A warning is an investigation aid, not proof of malicious intent, and a clean visual inspection alone is not a complete security review.
Primary reference: the researchers’ Trojan Source explanation and linked paper. Historical context reviewed: 30 October 2026.
