GCVE-110-OSM-2026-14353

This package is self-described as a proof-of-concept security test ('rootxravi-poc-security' in description, author, and index.js console.log), published by a brand-new account ('devtest91001', ~1.5 hours old) that simultaneously published 25 packages impersonating the legitimate '@goparrot-dashboard' and '@goparrot-dashboard-api' scoped namespaces — a classic dependency confusion attack pattern. The current entry point (index.js) contains only a console.log and no active malicious payload, consistent with an early-stage or test dependency confusion probe. The bulk publishing of namespace-squatting packages under a proton.me throwaway email address ('sysdataleak+1001@proton.me') with 'rootxravi-poc-security' branding suggests this is either a security researcher's authorized dependency confusion test or a reconnaissance probe establishing namespace presence before a payload is added. Given the explicit 'poc-security' self-labeling and absence of any active exfil or credential-theft code, this is most likely a bug bounty/dependency confusion test, but the namespace squatting across 25 packages warrants review rather than automatic dismissal. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing