In this paper: (https://www.trojansource.codes/trojan-source.pdf) researchers from the University of Cambridge describe an attack which uses special Unicode characters to inject invisible or modified code. As far as I can tell any compiler taking Unicode input - as ocamlc - is affected by this.

There is an easy remedy, which is rejecting sources which contain such characters.