GCVE-110-OSM-2026-14336

This package is a self-identified proof-of-concept dependency confusion attack against the @goparrot-dashboard namespace, authored by 'rootxravi-poc-security' and published from a brand-new account (devtest91001, age ~1.6 hours) with 25 similarly named packages mimicking private goparrot-dashboard internal modules. The index.js contains only a console.log identifying the PoC, with no active payload or exfiltration code in the current version. The pattern — new account, rapid namespace squatting across internal-looking scoped packages, protonmail-derived email (sysdataleak+1001@proton.me), and self-description as 'poc-security' — is consistent with a dependency confusion bug bounty test or a reconnaissance probe. No exfil endpoints or malicious code are present in the scanned version, but the infrastructure (25 packages, protonmail subdomain 'sysdataleak') warrants flagging for the goparrot-dashboard maintainers. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing