MAL-2026-18499: Malicious code in @goparrot-dashboard/franchise-management (npm)

Published Nov 2, 2026

Updated

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1 has no install scripts, and its index.js only prints a "[rootxravi-poc-security] @goparrot-dashboard/franchise-management" marker when loaded. The npm account devtest91001 published it on 2026-11-01 with 24 other packages in @goparrot-dashboard and @goparrot-dashboard-api, including @goparrot-dashboard/app, whose 0.0.2 sends the hostname, user and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun) from a preinstall script.

Affected Software

1 affected component

npm/@goparrot-dashboard/franchise-management=0.0.1

Event History

Nov 2, 2026

Advisory Published

via OSV·03:53 AM

Data Sourced

via OSV·03:53 AM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required for this package to affect a build?

A build must resolve the @goparrot-dashboard scope from the public npm registry and request a private package with the same name. The described dependency-confusion behavior depends on npm selecting the public package instead of the intended private one.

Does version 0.0.1 execute code automatically during installation?

No. Version 0.0.1 has no install scripts. Its index.js only prints a marker when the package is loaded.

How can I check whether this package was introduced into an environment?

Check dependency manifests and lockfiles for @goparrot-dashboard/franchise-management at version 0.0.1, and review npm registry configuration to determine whether the @goparrot-dashboard scope resolves from npm. Runtime logs may contain the marker "[rootxravi-poc-security] @goparrot-dashboard/franchise-management" if the module was loaded.

What should be done if private packages use the @goparrot-dashboard scope?

Ensure that the @goparrot-dashboard scope resolves to the intended private registry rather than public npm, and investigate builds or lockfiles that may have resolved the public 0.0.1 package.

MAL-2026-18499: Malicious code in @goparrot-dashboard/franchise-management (npm)

Affected Software

Event History

Frequently Asked Questions

What conditions are required for this package to affect a build?

Does version 0.0.1 execute code automatically during installation?

How can I check whether this package was introduced into an environment?

What should be done if private packages use the @goparrot-dashboard scope?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for this package to affect a build?

Does version 0.0.1 execute code automatically during installation?

How can I check whether this package was introduced into an environment?

What should be done if private packages use the @goparrot-dashboard scope?