security: remove GlassWorm malware payload from main.js

[Influwealth]

Summary

• Removes a block of invisible Unicode (Variation Selector) characters appended to main.js, plus the trailing decoder/eval() one-liner that read and executed them.

What it did

The hidden payload decrypts (AES-256-CBC, hardcoded key/IV) to a loader that queries the Solana blockchain (getSignaturesForAddress on address BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC) for a C2 URL hidden in a transaction memo, downloads a second-stage payload, and eval()s it. Includes a "skip if Russian system" evasion check and drops ~/init.json as an infection marker — consistent with the GlassWorm supply-chain campaign.

Recommendation

• Rotate any credentials/tokens (npm, GitHub, cloud, crypto wallets) that may have been exposed on machines that ran this Electron app.
• Check developer machines for ~/init.json.

Test plan

• Legitimate Electron main.js bootstrap code preserved and unchanged
• Re-scanned repo for invisible-Unicode/variation-selector indicators — none remain

---

Generated by Claude Code