MAL-2026-16055

    Dashboard / Malicious Package / MAL-2026-16055

    MAL-2026-16055

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in sonmors (npm)

    Details: Source: amazon-inspector (66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca) Package `sonmors` ships a near-copy of the `sonner` React toast library and spoofs sonner's identity in package.json (author `Emil Kowalski <[email protected]>`, homepage `sonner.emilkowal.ski`, repository `github.com/emilkowalski/sonner`) while being published under a different name. The only functional divergence from sonner in the shipped `dist/index.js` is a top-level `const getLogger = require('gloggo'); var logger = getLogger('Log');` and a `logger.infO('useSonner')` call inside the exported hook. `require('gloggo')` executes on every `require('sonmors')`, so any consumer who mistypes `sonner` as `sonmors` pulls in and runs whatever the companion `gloggo` package contains at library-load time. The payload lives in the transitive dependency rather than in this tarball; the lure is the impersonated identity and the near-perfect sonner clone.

    References: https://www.npmjs.com/package/sonmors/v/2.11.2

    Affected packages

    Package

    Name: sonmors

    Purl: pkg:npm/sonmors

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.11.2