MAL-2026-16055 Malicious code in sonmors (npm)

Package sonmors ships a near-copy of the sonner React toast library and spoofs sonner's identity in package.json (author Emil Kowalski <[email protected]>, homepage sonner.emilkowal.ski, repository github.com/emilkowalski/sonner) while being published under a different name. The only functional divergence from sonner in the shipped dist/index.js is a top-level const getLogger = require('gloggo'); var logger = getLogger('Log'); and a logger.infO('useSonner') call inside the exported hook. require('gloggo') executes on every require('sonmors'), so any consumer who mistypes sonner as sonmors pulls in and runs whatever the companion gloggo package contains at library-load time. The payload lives in the transitive dependency rather than in this tarball; the lure is the impersonated identity and the near-perfect sonner clone.