GCVE-110-OSM-2026-14355

This package is a self-described proof-of-concept security test ('rootxravi-poc-security' in description, author, and console.log) that mimics an internal GoParrot dashboard namespace, consistent with a dependency confusion attack probe. The publisher account is brand new (under 2 hours old at publish time), published 25 packages in rapid succession impersonating private @goparrot-dashboard and @goparrot-dashboard-api scopes, and the email uses a proton.me address with a 'sysdataleak' prefix — a deliberate provocation. The entrypoint contains no exfiltration code in the scanned version, suggesting this may be an early-stage probe or bug bounty test rather than a live payload delivery. However, the namespace squatting pattern across 25 packages and the 'sysdataleak' email strongly suggest adversarial intent even if this specific version is inert. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing