MAL-2026-18100 Malicious code in unicode-title-normalizer (npm)

[email protected] was published to npm on 2026-10-19 at 14:50:39 UTC by the account bluntyblunks, about one minute after npm's staged-publish placeholder 0.0.0-stage. The tarball has three files. index.js exports a function that returns the string "hello", and README.md is an unedite...

Malicious code in unicode-title-normalizer (npm)

[email protected] was published to npm on 2026-10-19 at 14:50:39 UTC by the account bluntyblunks, about one minute after npm's staged-publish placeholder 0.0.0-stage. The tarball has three files. index.js exports a function that returns the string "hello", and README.md is an unedite...

Malware in unicode-title-normalizer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview unicode-title-normalizer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...