GCVE-110-OSM-2026-14344

This package is a self-identified proof-of-concept security test ('rootxravi-poc-security' appears in the description, author field, and index.js log statement) published under a squatted @goparrot-dashboard namespace. The publisher 'devtest91001' using a proton.me address created the account less than 2 hours before publishing 25 packages impersonating what appears to be a real organization's internal npm scope — a classic dependency confusion attack setup. The index.js entrypoint contains no malicious payload in version 0.0.1 (only a console.log), consistent with a PoC or reconnaissance phase where the attacker confirms install-time execution before deploying a payload. The combination of a brand-new account, proton.me email, 25 namespace-squatting packages, and explicit 'poc-security' labeling matches a dependency confusion bug bounty or red team exercise rather than an active criminal campaign, but the infrastructure is indistinguishable from a real attack. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing