Dependency-confusion probe packages: @goparrot-dashboard scope on npm — squatting scope published 25 packages, one exfiltrates host data (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
On 2026-11-01 the npm account devtest91001 published 25 packages under the newly created @goparrot-dashboard and @goparrot-dashboard-api scopes, adjacent to GoParrot's public @goparrot scope, in a dependency-confusion campaign. Four packages (franchise-menu-settings, settings, marketing, order, all 0.0.1) are inert probes that print a '[rootxravi-poc-security]' marker on load with no install scripts, but @goparrot-dashboard/app 0.0.2 runs a preinstall script that sends the hostname, username and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun). Any build resolving these scoped names from public npm instead of a private registry would install the malicious packages. GitHub advisories (GHSA-89qx-w49w-4q48, GHSA-q8c5-hxhq-jprv, GHSA-332r-cpwr-xr6h, GHSA-fc2g-x424-gvq4) were published 2026-11-03 with no patched versions; affected packages should be removed from npm and blocked.
What to do
- Audit lockfiles and build logs for any @goparrot-dashboard or @goparrot-dashboard-api packages and remove them immediately
- Check CI/build hosts for outbound connections to iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and treat any hit as host-data exposure
- Configure npm/.npmrc to never resolve internal scopes from the public registry (scope-scoped registry mapping, --no-audit installs from private feed only)
- Block the callback domain at DNS/proxy egress and add it to threat-intel blocklists
- Reserve/claim internal package names publicly or use scoped registry allowlists to prevent future dependency confusion
Sources
All live incidents on Threat Watch
