GCVE-110-OSM-2026-14356

This package is explicitly self-described as a proof-of-concept security test ('rootxravi-poc-security'), published by a brand-new account (devtest91001, ~1.5 hours old at publish time) squatting on the @goparrot-dashboard-api and @goparrot-dashboard namespaces — a clear dependency confusion attempt pattern. The publisher account has 25 packages all mimicking internal goparrot.com namespace packages, consistent with a dependency confusion reconnaissance campaign. The current package's index.js contains only a console.log and no active payload, so there is no confirmed exfiltration or code execution beyond the squatting itself. The 'rootxravi-poc-security' branding and proton.me email (sysdataleak+1001) suggests this may be a bug bounty or security research demonstration, but the pattern of 25 namespace-squatting packages warrants flagging rather than clean suppression. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing