unicode-title-normalizer@1.0.5
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected runtime code performs the package's stated text normalization, and the CLI processes user-supplied arguments. The install hook is a noisy static signal, but its referenced script is absent from the declared package files and no concrete attack behavior was found.
Decision evidence
public snapshot- package.json points to index.js and cli.js; its files list omits install.sh, though the install hook only prints text and calls that script.
- index.js normalizes caller-provided text by stripping presentation characters, applying Unicode normalization, collapsing whitespace, and optionally normalizing colors and title casing.
- cli.js passes command-line text to the normalization functions and writes the result to standard output.
- The manifest does define an install lifecycle hook that invokes a shell command.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json points to index.js and cli.js; its files list omits install.sh, though the install hook only prints text and calls that script.
package.jsonView on unpkg · L5Findings
Affected versions and remediation
This report applies to unicode-title-normalizer@1.0.5.
See all versions of unicode-title-normalizer for other recorded verdicts.
- Review the evidence and your use of unicode-title-normalizer@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.