GCVE-110-OSM-2026-14347

This package self-identifies as a proof-of-concept security test via the description 'rootxravi-poc-security' and the author field 'rootxravi-poc-security', and the entrypoint contains only a console.log with the same tag — no malicious code is present. However, the publisher 'devtest91001' with a proton.me email published 25 packages impersonating the @goparrot-dashboard and @goparrot-dashboard-api namespaces within hours of account creation, which is a classic dependency confusion attack pattern. The account age is under 2 hours, no source repository is linked, and all packages appear to be namespace squatting probes. While the current version's code is benign, the campaign structure (proton.me throwaway email, 25 namespace-squatting packages, brand-new account) warrants review and takedown coordination rather than OSM submission as malware. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing