Is @goparrot-dashboard/app malicious?
Yes. Protet confirmed 1 version of @goparrot-dashboard/app as malicious
First confirmed on 2026-11-01.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 0.0.2 | 2026-11-01 | PROTET-NPM-2026-135 |
What it does
Install script sends hostname, user name and working directory to an oast.fun host over DNS and HTTPS
@goparrot-dashboard/app 0.0.2 contains only package.json and index.js; its preinstall script runs node index.js. The script runs the hostname and whoami commands, reads the working directory, then performs a DNS lookup of <user>.<hostname>.rootxravi.iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and an HTTPS request to https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc with the package name, hostname, user name, working directory and a timestamp in the query string. Errors are silently ignored. Only version 0.0.2 has an install script; 0.0.1 and 0.0.3 do not. Remove the package and treat machines that installed 0.0.2 as having disclosed their hostname, user name and working directory to a third party.
Indicators
Domainsiuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun
URLshttps://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-01: 0.0.2 named by Protet Intel