GCVE-110-OSM-2026-14338

This package is a self-described proof-of-concept dependency confusion or namespace squatting test targeting the @goparrot-dashboard namespace, authored by 'rootxravi-poc-security' via a brand-new account (devtest91001, npmAccountAge ~1.6 hours) that published 25 packages in rapid succession impersonating the goparrot-dashboard internal namespace. The entry point contains no malicious payload — just a console.log confirming the package identity — so there is no active exfiltration or code execution in the current version. However, the pattern (new account, 25 scoped packages mirroring an internal namespace, author name explicitly referencing 'poc-security', protonmail address) is consistent with a dependency confusion security research exercise or a live attack probe awaiting payload delivery. The package warrants human review to determine whether it represents authorized security testing against GoParrot or an unauthorized squatting attempt. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing