MAL-2026-18492 Malicious code in @goparrot-dashboard/app (npm)

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 ...