GCVE-110-OSM-2026-14335

This package is self-described as 'rootxravi-poc-security' and authored by 'rootxravi-poc-security', strongly suggesting it is a dependency confusion or proof-of-concept security test targeting the @goparrot-dashboard namespace. The publisher account 'devtest91001' is less than a day old (email: sysdataleak+1001@proton.me) and published 25 packages covering the entire @goparrot-dashboard and @goparrot-dashboard-api namespaces in rapid succession — a classic dependency confusion enumeration pattern. The entry point contains only a console.log and no malicious code is present in the scanned version, which is consistent with a PoC probe rather than an active payload. However, the account naming ('devtest91001', 'sysdataleak') and the breadth of namespace squatting warrants elevated concern regardless of the benign payload. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing