sonmors

{"modified":"2026-09-09T00:16:19Z","published":"2026-09-09T00:16:19Z","schema_version":"1.7.4","id":"MAL-2026-16055","summary":"Malicious code in sonmors (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca)\nPackage `sonmors` ships a near-copy of the `sonner` React toast library and spoofs sonner's identity in package.json (author `Emil Kowalski <e@emilkowal.ski>`, homepage `sonner.emilkowal.ski`, repository `github.com/emilkowalski/sonner`) while being published under a different name. The only functional divergence from sonner in the shipped `dist/index.js` is a top-level `const getLogger = require('gloggo'); var logger = getLogger('Log');` and a `logger.infO('useSonner')` call inside the exported hook. `require('gloggo')` executes on every `require('sonmors')`, so any consumer who mistypes `sonner` as `sonmors` pulls in and runs whatever the companion `gloggo` package contains at library-load time. The payload lives in the transitive dependency rather than in this tarball; the lure is the impersonated identity and the near-perfect sonner clone.\n","affected":[{"package":{"ecosystem":"npm","name":"sonmors"},"versions":["2.11.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"4471af10dba646cd93953ad86e08f27bf4b6ed37a206f6acf8db4746fca311c2","tlsh":"b063e94572b613254d1760555f9f402c613168037a89f8183a8c8e8cafe67feadf3bda"},{"path":"package.json","sha256":"e585b9f24b97e9db3ae79419cc4b2f6846a4ed853bbe79a4263628c8517831eb","tlsh":"7431ac19c4680da319d521e9b97a1617b13a04471ea8be1c33ce823c4f4dadf42bf6ad"}],"package_integrity":[{"filename":"sonmors-2.11.2.tgz","hashes":{"sha1":"48f73d62dace6fd5d5c038a9e440c20306fc3e11","sha512_sri":"sha512-RbLlJ9mZYtVwpvPHh74U/2cTZkAgV7CInDrAefzhjebo2X7b/U3F02/F/eZbwOZoarFhIf20H5Hv3FWp0vb3Bg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sonmors/v/2.11.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019725","import_time":"2026-09-09T00:47:57.811268878Z","modified_time":"2026-09-09T00:16:19Z","sha256":"66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca","source":"amazon-inspector","versions":["2.11.2"]}]}}