Vulnerability MAL-2026-18492

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs node index.js on npm install, which collects the hostname, the whoami user and the working directory, looks up a DNS name built from the user and host names under iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun with nslookup, and sends the same values in a curl request to https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other @goparrot-dashboard and @goparrot-dashboard-api packages that print the same "rootxravi-poc-security" marker.