Live › package › MAL-2026-18498
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-03 05:47 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @goparrot-dashboard/franchise-directory | npm | = 0.0.1 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@goparrot-dashboard/franchise-directory is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1 has no install scripts, and its index.js only prints a "[rootxravi-poc-security] @goparrot-dashboard/franchise-directory" marker when loaded. The npm account devtest91001 published it on 2026-11-01 with 24 other packages in @goparrot-dashboard and @goparrot-dashboard-api, including @goparrot-dashboard/app, whose 0.0.2 sends the hostname, user and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun) from a preinstall script.
This page as .md · .json · in your agent: get_signal("MAL-2026-18498")