GCVE-110-OSM-2026-14340

This package self-identifies as a proof-of-concept security test: the description is 'rootxravi-poc-security', the author field matches, and the entrypoint only logs a marker string. The publisher account is less than a day old and published 25 packages squatting the entire @goparrot-dashboard and @goparrot-dashboard-api namespaces in a rapid burst, which is a classic dependency confusion attack pattern against the GoParrot organization. The actual package code contains no malicious payload — no network calls, no credential reads, no obfuscation — consistent with a bounty researcher planting namespace-squatting placeholders to demonstrate the vulnerability. The combination of self-identification as a POC and zero malicious code warrants a suspicious-but-benign disposition rather than a malicious verdict, but the namespace squatting scope is broad enough to flag for review. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing