formatting-subtitles@1.0.1

Analysis

This package impersonates the unicode-title-normalizer library — it declares a bin entry named "unicode-title-normalizer" pointing at cli.js, uses that name as its README title, and depends on unicode-title-normalizer@1.1.0 — while shipping a staged shell payload. package.json defines a preinstall hook, "sh ./prepare.js && exit 0", but prepare.js is not included in the tarball; the payload instead sits in the shipped file x.js (listed in package.json "files") as a shell block that (1) beacons to hxxps://webhook[.]site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1 and (2) downloads hxxps://api[.]github[.]com/gists/da04f14c93acbe9a7aef827be0a2e91c, extracts the gistfile1.txt content with jq into a file named x, and executes it with sh — a remote second-stage fetch-and-run. The remaining files (index.js, cli.js) are a functional Unicode/CSS-color title normalizer used as cover. IOCs: webhook[.]site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1, api[.]github[.]com/gists/da04f14c93acbe9a7aef827be0a2e91c, dropped file "x".