GCVE-110-OSM-2026-14350

This package is self-described as a proof-of-concept security test ('rootxravi-poc-security'), published by a brand-new account ('devtest91001', ~1.6 hours old) with 25 packages all mimicking the legitimate @goparrot-dashboard namespace — a clear dependency confusion attack pattern. The publisher bulk-published 25 packages in rapid succession impersonating private internal package names, which is a well-known supply chain attack technique. The entrypoint is currently benign (just a console.log), consistent with a PoC or initial-stage placeholder, but the infrastructure and naming pattern represent real risk to any organization using the @goparrot-dashboard private namespace. No active exfiltration code is present in the scanned version, hence 'suspicious' rather than 'malicious'. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing