{"id":"MAL-2026-18513","kind":"package","aliases":["MAL-2026-18513"],"related":[],"title":"Malicious code in @goparrot-dashboard-api/role-v2 (npm)","description":"@goparrot-dashboard-api/role-v2 is a dependency-confusion probe: it takes a name in a `@goparrot-dashboard-api` scope that its publisher created on npm, next to GoParrot's public `@goparrot` scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1 has no install scripts, and its `index.js` only prints a \"[rootxravi-poc-security] @goparrot-dashboard-api/role-v2\" marker when loaded. The npm account devtest91001 published it on 2026-11-01 with 24 other packages in `@goparrot-dashboard` and `@goparrot-dashboard-api`, including @goparrot-dashboard/app, whose 0.0.2 sends the hostname, user and working directory to an interactsh callback host (`iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun`) from a preinstall script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@goparrot-dashboard-api/role-v2","fixed":[],"affected":"= 0.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:53:39+00:00","first_seen_at":"2026-11-03T05:47:50+00:00","triaged_at":"2026-11-03T05:49:41+00:00","updated_at":"2026-11-03T05:50:50+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':111C '-11':110C '-18513':12A,15A '-2026':11A,14A '/app':129C '/role-v2':8A,20A,27C,98C '0.0.1':79C '0.0.2':131C '2026':109C '24':113C 'account':104C 'api':7A,19A,26C,43C,97C,124C 'build':60C 'callback':142C 'code':2A 'confus':32C 'creat':48C 'dashboard':6A,18A,25C,42C,96C,119C,123C,128C 'depend':31C 'dependency-confus':30C 'devtest91001':105C 'directori':138C 'get':67C 'goparrot':5A,17A,24C,41C,53C,56C,95C,118C,122C,127C 'goparrot-dashboard':117C,126C 'goparrot-dashboard-api':4A,16A,23C,40C,94C,121C 'host':143C 'hostnam':134C 'includ':125C 'index.js':86C 'instal':82C 'instead':69C 'interactsh':141C 'iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun':144C 'load':101C 'mal':10A,13A 'malici':1A,21B 'marker':99C 'name':37C,77C 'next':51C 'npm':9A,50C,66C,103C 'packag':22B,73C,115C 'poc':92C 'preinstal':147C 'print':88C 'privat':72C 'probe':33C 'public':55C 'publish':47C,106C 'resolv':62C 'rootxravi':91C 'rootxravi-poc-secur':90C 'scope':44C,57C,64C 'script':83C,148C 'secur':93C 'send':132C 'take':35C 'user':135C 'version':78C 'whose':130C 'work':137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["rolev2"],"ptokens":["api","dashboard","goparrot","role","v2"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T03:53:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18513","url":"https://osv.dev/vulnerability/MAL-2026-18513","severity":"critical","published_at":"2026-11-02T03:53:39+00:00","modified_at":"2026-11-03T05:00:11+00:00","first_seen_at":"2026-11-03T05:47:50+00:00","fetched_at":"2026-11-03T05:47:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}