Supply-chain attack using invisible code hits GitHub and other repositories

Unicode that’s invisible to the human eye was largely abandoned—until attackers took notice.