GCVE-110-OSM-2026-14351

This package is self-described as 'rootxravi-poc-security' and authored by 'rootxravi-poc-security', with an index.js that only logs its own name — consistent with a dependency confusion or proof-of-concept security test targeting the @goparrot-dashboard namespace. The publisher account (devtest91001, proton.me email) is less than a day old and published 25 packages in that namespace simultaneously, which is a classic dependency confusion enumeration pattern. No malicious code or exfil is present in the current version, but the pattern of squatting a private namespace under a new throwaway account with PoC branding is itself a security signal that warrants review. The package does not appear to be delivering active malware, but it is clearly not a legitimate library. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing