{"id":"MAL-2026-18506","kind":"package","aliases":["MAL-2026-18506"],"related":[],"title":"Malicious code in @goparrot-dashboard/menu (npm)","description":"@goparrot-dashboard/menu is a dependency-confusion probe: it takes a name in a `@goparrot-dashboard` scope that its publisher created on npm, next to GoParrot's public `@goparrot` scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1 has no install scripts, and its `index.js` only prints a \"[rootxravi-poc-security] @goparrot-dashboard/menu\" marker when loaded. The npm account devtest91001 published it on 2026-11-01 with 24 other packages in `@goparrot-dashboard` and `@goparrot-dashboard-api`, including @goparrot-dashboard/app, whose 0.0.2 sends the hostname, user and working directory to an interactsh callback host (`iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun`) from a preinstall script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@goparrot-dashboard/menu","fixed":[],"affected":"= 0.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:53:39+00:00","first_seen_at":"2026-11-03T05:47:50+00:00","triaged_at":"2026-11-03T05:49:41+00:00","updated_at":"2026-11-03T05:50:50+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':106C '-11':105C '-18506':11A,14A '-2026':10A,13A '/app':124C '/menu':7A,18A,24C,93C '0.0.1':75C '0.0.2':126C '2026':104C '24':108C 'account':99C 'api':119C 'build':56C 'callback':137C 'code':2A 'confus':29C 'creat':44C 'dashboard':6A,17A,23C,39C,92C,114C,118C,123C 'depend':28C 'dependency-confus':27C 'devtest91001':100C 'directori':133C 'get':63C 'goparrot':5A,16A,22C,38C,49C,52C,91C,113C,117C,122C 'goparrot-dashboard':4A,15A,21C,37C,90C,112C,121C 'goparrot-dashboard-api':116C 'host':138C 'hostnam':129C 'includ':120C 'index.js':82C 'instal':78C 'instead':65C 'interactsh':136C 'iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun':139C 'load':96C 'mal':9A,12A 'malici':1A,19B 'marker':94C 'name':34C,73C 'next':47C 'npm':8A,46C,62C,98C 'packag':20B,69C,110C 'poc':88C 'preinstal':142C 'print':84C 'privat':68C 'probe':30C 'public':51C 'publish':43C,101C 'resolv':58C 'rootxravi':87C 'rootxravi-poc-secur':86C 'scope':40C,53C,60C 'script':79C,143C 'secur':89C 'send':127C 'take':32C 'user':130C 'version':74C 'whose':125C 'work':132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["menu"],"ptokens":["dashboard","goparrot","menu"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T03:53:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18506","url":"https://osv.dev/vulnerability/MAL-2026-18506","severity":"critical","published_at":"2026-11-02T03:53:39+00:00","modified_at":"2026-11-03T05:00:11+00:00","first_seen_at":"2026-11-03T05:47:50+00:00","fetched_at":"2026-11-03T05:47:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}