The npm package unicode-title-normalizer@1.0.0 contained a malicious install script designed to exfiltrate GitHub Actions CI tokens to a third-party webhook URL. The package's code itself was benign, but the install lifecycle script attempted to send the GITHUB_TOKEN environment variable to an attacker-controlled endpoint. The package was removed by npm shortly after discovery. This package appears to be a typosquatting or dependency confusion attempt targeting CI environments.