GCVE-110-OSM-2026-14337

This package is self-described as 'rootxravi-poc-security' and its index.js confirms it is a proof-of-concept security test — it does nothing but log its own name. However, the publisher 'devtest91001' used a proton.me address with a sysdataleak prefix and published 25 packages namespaced under @goparrot-dashboard and @goparrot-dashboard-api within minutes of creating the account, which is a classic dependency confusion attack pattern targeting an organization's private npm namespace. The account age of ~0.07 days and the burst of 25 packages squatting a single organization's namespace warrants flagging even if the current payload is inert. The self-identification as a PoC test slightly moderates the verdict, but the operational pattern (namespace squatting under a real company's brand with a new proton.me account) is consistent with a dependency confusion reconnaissance campaign. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing