formatting-subtitles-for-claude@1.0.1

Summary

The package declares a postinstall hook sh./node_modules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the separate npm dependency unicode-title-normalizer on every installer at install time. The package's own visible source (index.js, cli.js, README) is a near-verbatim clone of unicode-title-normalizer's documented API — the README begins # unicode-title-normalizer and index.js re-implements normalizeTitle/normalizeColor — while the package is published under the unrelated name formatting-subtitles-for-claude. The name/content mismatch combined with the lifecycle hook shelling out to the dependency's x.js is a dropper shape: the installer-facing code is a decoy, and the install-time code path executed on the host is whatever bytes the dependency's maintainer chooses to ship at x.js, with no pinning beyond a version range, no integrity check, and no inspection.

Source: amazon-inspector (f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700)