{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14349","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-01T06:58:12Z","dateUpdated":"2026-11-01T07:04:02Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This package is self-described as a proof-of-concept security test ('rootxravi-poc-security' appears in the description, author field, and index.js console.log), published by a brand-new account ('devtest91001', npmAccountAge ~1.6 hours) that simultaneously published 25 packages squatting on the @goparrot-dashboard and @goparrot-dashboard-api namespaces. The pattern — mass namespace squatting under a fresh account with no repository, rapid version publishing, and a poc-security label — is consistent with a dependency confusion attack test or bug bounty research. The current entry content is benign (a single console.log), but the scale of namespace squatting across 25 packages targeting what appears to be a private organization's namespace (goparrot-dashboard) warrants caution. No code-level exfiltration or C2 indicators are present in this version.\n\nENTRY\n  index.js (main: index.js)\n\nADDITIONAL FINDINGS\n  - Brand New Package\n  - Very New NPM Publisher Account\n  - Rapid Version Publishing","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/44b56105-78b9-4461-8a2d-c28636d1fa9d","name":"Malicious npm package: @goparrot-dashboard/combo-group","tags":["advisory"]},{"url":"https://registry.npmjs.org/@goparrot-dashboard/combo-group","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"@goparrot-dashboard/combo-group","collectionURL":"https://registry.npmjs.org","packageName":"@goparrot-dashboard/combo-group","repo":"","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}