ui-design-patterns

The fragment appears to be a benign UI examples implementation, not malware. It contains a significant potential DOM XSS vulnerability because the caller-provided message is inserted into innerHTML without sanitization. The risk depends on whether untrusted input can reach showToast; the supplied fragment alone does not establish that call path. The type parameter should also be allowlisted. No malicious supply-chain behavior is evident.