Scan and sanitise source files by removing invisible, dangerous, and unwanted Unicode characters before build.

unicode-scrub is a lightweight CLI and library that protects codebases from:

• invisible Unicode characters (zero-width spaces, joiners, BOMs)
• bidirectional control characters (Trojan Source class issues)
• non-breaking spaces and copy-paste artifacts

It is designed to run safely in build pipelines and CI.

By default, unicode-scrub scans:

• TypeScript / JavaScript (.ts, .tsx, .js, .jsx)
• SCSS / CSS (.scss, .css)
• HTML (.html)
• PHP (.php)
• Markdown (.md)

Markdown is treated differently from code: visible typography (curly quotes, dashes) is preserved.

Run directly with npx:

npx unicode-scrub "src/**/*"

Or install locally:

npm install --save-dev @lnpg/unicode-scrub

unicode-scrub "src/**/*"

Scans files and reports issues. Exits with a non-zero status if any issues are found.

unicode-scrub --fix "src/**/*"

Removes or normalises offending characters and rewrites files safely.

{
  "scripts": {
    "prebuild": "unicode-scrub \"src/**/*\"",
    "build": "vite build"
  }
}

This ensures Unicode hygiene before every build.

Optional JSON configuration file:

{
  "normaliseSpaces:": true,
  "byExt": {
    "md": {
      "normaliseSpaces": true
    }
  }
}

• Global options apply to all file types.
• byExt allows per-extension overrides.

• It does not parse ASTs.
• It does not lint syntax.