registry / unicode-title-normalizer / 1.0.4

unicode-title-normalizer@1.0.4

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The install hook is a packaging issue: it calls a local script omitted from the package file list. The inspected runtime code processes user-supplied text and colors, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package triggers its declared install hook.

Impact

The missing script can cause installation to fail, but no malicious effect was established.

Mechanism

The hook prints a message and then calls ./install.sh; that file is not among the files listed for the package. The reviewed CLI and library code normalize user-supplied text and colors.

AI rationale

Evidence

package.jsoncli.jsindex.js

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json lists only index.js, cli.js, and README.md, while its install hook calls ./install.sh, which is absent from the package file list.
The CLI takes supplied text and passes it to the package’s normalization functions.
The library normalizes text and exports color and title normalization functions.

Evidence against

An install lifecycle hook is declared, but the inspected source shows no malicious action associated with it.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 13.4 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.install = echo "hey hey hey hoooo" && ./install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"files": [ "index.js", "cli.js", "README.md" ], "scripts": { "test": "node --test", "start": "node cli.js", "install": "echo \"hey hey hey hoo

High

Missing Postinstall Target

package.json lists only index.js, cli.js, and README.md, while its install hook calls ./install.sh, which is absent from the package file list.

package.jsonView on unpkg · L9

17"install": "echo \"hey hey hey hoooo\" && ./install.sh" }, "engines": { "node": ">=18"

High

Missing Postinstall Target

package.json lists only index.js, cli.js, and README.md, while its install hook calls ./install.sh, which is absent from the package file list.

package.jsonView on unpkg · L17

•scripts.install = echo "hey hey hey hoooo" && ./install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli.jsView file

51if (positional.length === 0) fail(usage()); const input = positional.join(" "); const output = colorMode ? normalizeColor(input) : normalizeTitle(input, { form,

Low

Ai Review Evidence

The CLI takes supplied text and passes it to the package’s normalization functions.

cli.jsView on unpkg · L51

index.jsView file

412function normalizeTitle(input, options) { const value = asString(input, "title"); const opts = resolveOptions(options); const allowed = new Set(["NFC", "NFD", "NFKC", "NFKD"]); if (!allowed.has(opts.form)) { throw new TypeError(`unsupported normali

Low

Ai Review Evidence

The library normalizes text and exports color and title normalization functions.

index.jsView on unpkg · L412

427module.exports = { NAMED_COLORS, normalizeColor, normalizeTitle, };

Low

Ai Review Evidence

The library normalizes text and exports color and title normalization functions.

index.jsView on unpkg · L427

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.install = echo "hey hey hey hoooo" && ./install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"files": [ "index.js", "cli.js", "README.md" ], "scripts": { "test": "node --test", "start": "node cli.js", "install": "echo \"hey hey hey hoo

High

Missing Postinstall Target

package.json lists only index.js, cli.js, and README.md, while its install hook calls ./install.sh, which is absent from the package file list.

package.jsonView on unpkg · L9

17"install": "echo \"hey hey hey hoooo\" && ./install.sh" }, "engines": { "node": ">=18"

High

Missing Postinstall Target

package.json lists only index.js, cli.js, and README.md, while its install hook calls ./install.sh, which is absent from the package file list.

package.jsonView on unpkg · L17

Findings

3 High1 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighMissing Postinstall Targetpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LowHigh Entropy Strings

LowAi Review Evidencecli.js

LowAi Review Evidenceindex.js

Affected versions and remediation

This report applies to unicode-title-normalizer@1.0.4.

See all versions of unicode-title-normalizer for other recorded verdicts.

Review the evidence and your use of unicode-title-normalizer@1.0.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 09:31:37.879Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.