GCVE-110-OSM-2026-14341

This package is a self-identified proof-of-concept dependency confusion / security test published under the @goparrot-dashboard namespace, targeting a real organization's private package namespace. The author field, description, and console.log all reference 'rootxravi-poc-security', the npm account 'devtest91001' with email 'sysdataleak+proton.me' published 25 scoped packages across the entire @goparrot-dashboard and @goparrot-dashboard-api namespaces in under an hour, which is a classic dependency confusion enumeration pattern. The entrypoint contains only a benign console.log with no active exfiltration, so there is no confirmed malicious payload in the scanned version, but the account name, protonmail address with 'sysdataleak' prefix, and bulk namespace squatting are strong signals of hostile reconnaissance or a bounty test that should not be silently dismissed. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing