sonmors@2.11.2

Summary

Package sonmors ships a near-copy of the sonner React toast library and spoofs sonner's identity in package.json (author Emil Kowalski <e@emilkowal.ski>, homepage sonner.emilkowal.ski, repository github.com/emilkowalski/sonner) while being published under a different name. The only functional divergence from sonner in the shipped dist/index.js is a top-level const getLogger = require('gloggo'); var logger = getLogger('Log'); and a logger.infO('useSonner') call inside the exported hook. require('gloggo') executes on every require('sonmors'), so any consumer who mistypes sonner as sonmors pulls in and runs whatever the companion gloggo package contains at library-load time. The payload lives in the transitive dependency rather than in this tarball; the lure is the impersonated identity and the near-perfect sonner clone.

Source: amazon-inspector (66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca)