MalwarePublished 20 Oct 2026Updated 29 Oct 2026

unicode-title-normalizer (npm) · Malicious Code

Affects unicode-title-normalizerSource GCVE Database

Malicious package : remove unicode-title-normalizer and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18100

What to do

Remove unicode-title-normalizer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmunicode-title-normalizer	Affected 1.0.0 – 1.1.0 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package unicode-title-normalizer@1.0.0 contained a malicious install script designed to exfiltrate GitHub Actions CI tokens to a third-party webhook URL. The package's code itself was benign, but the install lifecycle script attempted to send the GITHUB_TOKEN environment variable to an attacker-controlled endpoint. The package was removed by npm shortly after discovery. This package appears to be a typosquatting or dependency confusion attempt targeting CI environments.

Impact

If installed within a GitHub Actions CI environment, the malicious install script could exfiltrate the GITHUB_TOKEN credential to an attacker-controlled endpoint, potentially compromising CI workflows and any secrets accessible via that token. On typical POSIX systems, the script likely fails due to syntax errors, limiting impact outside CI. However, any system running the package in a GitHub Actions context should be considered compromised, and all secrets and keys should be rotated. Removal of the package alone may not guarantee full remediation.

Defensive guidance

The package unicode-title-normalizer@1.0.0 has been removed from npm and replaced with a security placeholder. Users should remove this package immediately if installed. Any GitHub Actions tokens or secrets that may have been exposed should be rotated. Avoid installing packages from untrusted or unknown publishers, especially those with suspicious names or recent publication dates. Monitor CI workflows for unauthorized token usage.

Summary

The unicode-title-normalizer@1.0.0 npm package was published with a malicious install script that runs on npm install. The script attempts to send the GitHub Actions GITHUB_TOKEN environment variable to a webhook.site URL, potentially leaking CI credentials. The code exports a trivial function unrelated to the package name, indicating the package was crafted primarily for credential theft. The token is referenced in GitHub Actions expression syntax, which likely prevents execution in typical POSIX shells but would succeed in GitHub Actions workflows. The package was removed by npm the day after publication and replaced with a security placeholder. This behavior is consistent with a typosquatting or dependency confusion attack vector.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:10 UTC

Technical details

References

Community reviews