GCVE-110-OSM-2026-14342

This package is self-described as a proof-of-concept security test ('rootxravi-poc-security' appears in the description, author field, and the index.js console.log). The publisher account 'devtest91001' was created less than two hours before publishing, published 25 packages in a burst impersonating the '@goparrot-dashboard' and '@goparrot-dashboard-api' namespace — a clear dependency confusion pattern targeting a private organization. The index.js entrypoint contains only a console.log and no malicious payload in the scanned version, consistent with a PoC probe that has not yet deployed an active exfil stage. The pattern of squatting an entire private namespace with a brand-new account using a protonmail-aliased email matches dependency confusion reconnaissance, not a legitimate library. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing