GCVE-110-OSM-2026-14348

This package is self-identified as a proof-of-concept security test ('rootxravi-poc-security' in description, author, and index.js console.log), consistent with a dependency confusion or supply-chain security bounty exercise targeting the @goparrot-dashboard namespace. The publisher account is less than a day old, published 25 packages in rapid succession impersonating the entire @goparrot-dashboard private namespace, and used a proton.me email with a 'sysdataleak' prefix — a deliberate naming choice that signals intent testing. The actual index.js payload is benign (only a console.log), and there are no IOCs, network calls, or credential access. This looks like a bug bounty dependency confusion test rather than a live attack, but the namespace hijack pattern and email naming are concerning enough to warrant flagging. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing