GCVE-110-OSM-2026-14343

This package is a self-described proof-of-concept dependency confusion test ('rootxravi-poc-security' in both the description and index.js console.log), published by a brand-new account ('devtest91001', created ~1.6 hours before publication) using a proton.me email with a systematic naming convention suggesting automated tooling. The publisher registered 25 packages impersonating the '@goparrot-dashboard' and '@goparrot-dashboard-api' private namespaces in a single burst, which is a classic dependency confusion attack pattern. The index.js itself is benign (only a console.log), and the author label suggests this may be a legitimate security researcher testing dependency confusion against their own or a client's organization rather than a malicious actor. However, the use of a suspicious email pattern ('sysdataleak+1001@proton.me') and bulk namespace squatting warrants manual review to confirm researcher authorization. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing