GCVE-110-OSM-2026-14339

This package is self-described as 'rootxravi-poc-security' and authored by 'rootxravi-poc-security', strongly indicating a dependency confusion or proof-of-concept security test targeting the @goparrot-dashboard namespace. The publisher account is less than a day old and published 25 packages squatting the entire @goparrot-dashboard and @goparrot-dashboard-api namespace in a rapid burst, consistent with a dependency confusion attack sweep rather than a legitimate library. The entrypoint only logs a marker string and performs no exfiltration, confirming this is likely a reconnaissance/PoC test rather than an active malware payload. However, the pattern of namespace squatting across 25 internal-looking package names warrants a flag — even if the current payload is inert, the intent appears adversarial. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing