GCVE-110-OSM-2026-14334

This package is explicitly self-described as a proof-of-concept security test ('rootxravi-poc-security' in both description and author fields, and echoed in index.js). The publisher 'devtest91001' registered less than two hours before publishing, used a protonmail alias suggesting anonymity, and published 25 packages across the @goparrot-dashboard and @goparrot-dashboard-api namespaces in rapid succession — a classic dependency confusion sweep against a real organization (GoParrot). The index.js contains no malicious payload in the scanned version (0.0.1), only a console.log beacon, consistent with a bug bounty or internal red-team dependency confusion test. However, this cannot be ruled out as a staging package awaiting payload insertion, and the namespace squatting across 25 internal-looking scoped packages warrants recording. No exfil endpoints are confirmed in the current code. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing