Dependency-confusion probe: GoParrot dashboard scopes — 25 malicious npm packages by devtest91001 exfiltrate host data

Severity: critical · Patch status: no-fix-needed · Since 2026-11-03

On 2026-11-01 the npm account devtest91001 published 25 packages under the newly created @goparrot-dashboard and @goparrot-dashboard-api scopes, adjacent to GoParrot's public @goparrot scope, in a dependency-confusion campaign. Most packages (e.g. @goparrot-dashboard-api/orchestration 0.0.1, @goparrot-dashboard/combo-group 0.0.1, @goparrot-dashboard-api/users 0.0.1, @goparrot-dashboard/category 0.0.1) are probes with no install scripts whose index.js prints a '[rootxravi-poc-security]' marker when loaded. However @goparrot-dashboard/app 0.0.2 runs a preinstall script that sends the hostname, username and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun). Any build resolving these scopes from the public registry instead of a private registry would install the malicious packages. GitHub advisories published 2026-11-03 list affected versions with no patched versions; no evidence of compromise of GoParrot itself.

What to do

Audit lockfiles and CI logs for any @goparrot-dashboard/* or @goparrot-dashboard-api/* packages and remove them immediately
Check build hosts for outbound connections to iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and rotate credentials on any machine that installed these packages
Ensure private packages in these scopes are pinned to an internal registry and configure npm scope-registry mapping to prevent public resolution
Block the callback domain at egress and monitor for similar lookalike-scope publications
Report the packages and account to npm for takedown

Sources

All live incidents on Threat Watch

Threat Watch– active

All incidents

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More GoParrot incidents

Browse

Is your stack exposed? Get it tested.