GCVE-110-OSM-2026-14352

This package is a self-described proof-of-concept security test ('rootxravi-poc-security' in the description, author, and index.js) published under a squatted namespace targeting the legitimate 'goparrot-dashboard' organization. The publisher account 'devtest91001' (email sysdataleak+1001@proton.me) is less than a day old and mass-published 25 packages impersonating the full goparrot-dashboard scope in rapid succession — a dependency confusion attack pattern. The index.js payload is currently a benign beacon (console.log only), but the infrastructure — brand-new throwaway account, proton.me exfil-pattern email prefix 'sysdataleak', namespace squatting across 25 packages — is consistent with a dependency confusion reconnaissance operation. The package may be a declared PoC test by a researcher, but the 'sysdataleak' email prefix and scope of squatting warrant human review before dismissal. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing