registry / sonmors / 0.0.0

sonmors@0.0.0

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. On browser import, the component adds its bundled stylesheet to the current document.

Static reason

No blocking static signals were detected.

Trigger

An application imports and renders the React toast component.

Impact

Changes only the importing application's notification user interface.

Mechanism

Browser-side React toast rendering and stylesheet insertion.

AI rationale

The inspected package is a browser-side React toast component with no install lifecycle hook or harmful execution primitive. Its document write is limited to inserting bundled presentation CSS during normal import.

Evidence

package.jsondist/index.jsdist/index.mjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Importing the module injects its bundled CSS into the current browser document.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The package exports a React toast component and declares React and React DOM as peer dependencies.
No source evidence of network requests, credential access, filesystem access, shell execution, or dynamic code evaluation was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 138 KB of source, external domains: www.w3.org

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 Low

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidence

Affected versions and remediation

This report applies to sonmors@0.0.0.

See version security history for other recorded verdicts.

Review the evidence and your use of sonmors@0.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-29 09:25:40.424Z (UTC).