GCVE-110-OSM-2026-14345

This package self-identifies as a proof-of-concept security test via both the description field ('rootxravi-poc-security') and the author field, and the entrypoint only logs a marker string — no malicious payload is present in the code itself. However, the publisher 'devtest91001' used a protonmail alias with a leak-suggestive prefix ('sysdataleak+1001') and bulk-published 25 packages squatting the entire @goparrot-dashboard and @goparrot-dashboard-api namespaces within minutes of account creation, which is a classic dependency confusion attack pattern. The account is less than two hours old, the version publishing rate is extreme (~3123 versions/day), and there is no source repository — all hallmarks of a coordinated namespace squatting campaign even if this specific version carries no active payload. The 'poc-security' framing may indicate a bug bounty researcher, but the sheer scale of namespace takeover across private-org-style scoped packages warrants flagging rather than dismissal. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing