GCVE-110-OSM-2026-14346

This package is self-identified as a proof-of-concept security test ('rootxravi-poc-security' appears in the description, author field, and the entrypoint console.log), consistent with a dependency confusion attack probe targeting the @goparrot-dashboard namespace. The publisher account 'devtest91001' was created less than a day ago and published 25 packages in rapid succession, all impersonating @goparrot-dashboard scoped packages, which is a classic dependency confusion fingerprint. The entrypoint code itself is benign (only a console.log), with no exfiltration, network calls, or obfuscation present. However, the email 'sysdataleak+1001@proton.me' contains 'sysdataleak' which may indicate adversarial intent beyond a simple bounty test, and the volume of namespace squatting across 25 packages is notable. Treating as a dependency confusion/security-test probe: suspicious but not confirmed malicious. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing