sonmors@2.0.8: Clean npm security report (Allow)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed attack surface was established. This is a client-side React toast component with no install-time behavior or sensitive-system access.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports the library and renders its toast component.

Impact

Limited to intended in-page notification UI behavior.

Mechanism

Renders toast notifications and injects component CSS in the browser.

AI rationale

Source inspection found a conventional React toast bundle and no malicious behavior. The manifest contains no preinstall, install, or postinstall script.

Evidence

package.jsondist/index.jsdist/index.mjsREADME.md

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a React library entry point and has no install lifecycle hook.
The runtime bundle only imports React and ReactDOM, then implements toast UI state and rendering.
No network, filesystem, subprocess, dynamic-code, credential, or persistence behavior was found in the inspected package files.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 138 KB of source, external domains: www.w3.org

Source & flagged code

2 flagged

dist/index.jsView file

11Object.defineProperty(exports, '__esModule', { value: true }); var React = require('react'); var ReactDOM = require('react-dom'); function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; } var React__default = /*#__PURE__*/_interopDefault(React); var ReactDOM__default = /*#__PURE__*/_interopDefault(ReactDOM);

Low

Ai Review Evidence

The runtime bundle only imports React and ReactDOM, then implements toast UI state and rendering.

dist/index.jsView on unpkg · L11

437const ToastState = new Observer(); // bind this to the toast function const toastFunction = (message, data)=>{ return ToastState.message(message, data); }; const isHttpResponse = (data)=>{ return data && typeof data === 'object' && 'ok' in data && typeof data.ok === 'boolean' && 'status' in data && typeof data.status === 'number'; }; const basicToast = toastFunction; const getHistory = ()=>ToastState.toasts; const getToasts = ()=>ToastState.getActiveToasts(); // We use `Object.assign` to maintain the correct types as we would lose them otherwise const toast = Object.assign(basicToast,

Low

Ai Review Evidence

The runtime bundle only imports React and ReactDOM, then implements toast UI state and rendering.

dist/index.jsView on unpkg · L437

Source & flagged code

2 flagged · loading source

dist/index.jsView file

11Object.defineProperty(exports, '__esModule', { value: true }); var React = require('react'); var ReactDOM = require('react-dom'); function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; } var React__default = /*#__PURE__*/_interopDefault(React); var ReactDOM__default = /*#__PURE__*/_interopDefault(ReactDOM);

Low

Ai Review Evidence

The runtime bundle only imports React and ReactDOM, then implements toast UI state and rendering.

dist/index.jsView on unpkg · L11

437const ToastState = new Observer(); // bind this to the toast function const toastFunction = (message, data)=>{ return ToastState.message(message, data); }; const isHttpResponse = (data)=>{ return data && typeof data === 'object' && 'ok' in data && typeof data.ok === 'boolean' && 'status' in data && typeof data.status === 'number'; }; const basicToast = toastFunction; const getHistory = ()=>ToastState.toasts; const getToasts = ()=>ToastState.getActiveToasts(); // We use `Object.assign` to maintain the correct types as we would lose them otherwise const toast = Object.assign(basicToast,

Low

Ai Review Evidence

The runtime bundle only imports React and ReactDOM, then implements toast UI state and rendering.

dist/index.jsView on unpkg · L437

Findings

5 Low

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencedist/index.js

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code