If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca)
Package `sonmors` ships a near-copy of the `sonner` React toast library and spoofs sonner's identity in package.json (author `Emil Kowalski <e@emilkowal.ski>`, homepage `sonner.emilkowal.ski`, repository `github.com/emilkowalski/sonner`) while being published under a different name. The only functional divergence from sonner in the shipped `dist/index.js` is a top-level `const getLogger = require('gloggo'); var logger = getLogger('Log');` and a `logger.infO('useSonner')` call inside the exported hook. `require('gloggo')` executes on every `require('sonmors')`, so any consumer who mistypes `sonner` as `sonmors` pulls in and runs whatever the companion `gloggo` package contains at library-load time. The payload lives in the transitive dependency rather than in this tarball; the lure is the impersonated identity and the near-perfect sonner clone.