{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "@goparrot-dashboard/app"
   },
   "versions": [
    "0.0.2"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/@goparrot-dashboard/app/0.0.2"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "@goparrot-dashboard/app 0.0.2 contains only package.json and index.js; its preinstall script runs node index.js. The script runs the hostname and whoami commands, reads the working directory, then performs a DNS lookup of <user>.<hostname>.rootxravi.iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and an HTTPS request to https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc with the package name, hostname, user name, working directory and a timestamp in the query string. Errors are silently ignored. Only version 0.0.2 has an install script; 0.0.1 and 0.0.3 do not. Remove the package and treat machines that installed 0.0.2 as having disclosed their hostname, user name and working directory to a third party.",
 "id": "PROTET-NPM-2026-135",
 "modified": "2026-11-01T08:29:02Z",
 "published": "2026-11-01T08:29:02Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/@goparrot-dashboard/app/0.0.2"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install script sends hostname, user name and working directory to an oast.fun host over DNS and HTTPS"
}