GCVE-110-OSM-2026-14354

This package is self-described as a proof-of-concept security test ('rootxravi-poc-security' appears in both the description and the index.js console.log). The publisher account is brand-new (less than a day old), published 25 packages in rapid succession typosquatting the legitimate @goparrot-dashboard and @goparrot-dashboard-api namespaces, which is a classic dependency confusion attack setup. The current version's index.js contains only a console.log and no active malicious payload, consistent with a dependency confusion PoC probe designed to confirm install-time execution rather than exfiltrate data. The package self-identifies as a security test, so this is most likely a bug bounty or pen-test dependency confusion probe rather than a weaponized package, but the namespace targeting is real and warrants caution. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing