chai-plus@6.2.3

No blocking static signals were detected.

Runtime import/require of chai-plus

Executes attacker-selected third-party package code and initiates its remote-configured setup outside the caller's requested assertion-library function.

import-time global package installation and command execution

A consumer imports the declared main entrypoint. Its immediately invoked bootstrap constructs defaults for taskforge-9xv, runs npm list -g, installs taskforge-9xv@1.3.0 globally if absent, and executes its binary with a remote origin-server argument. This unrelated command execution is concealed by catch logic that normally suppresses bootstrap failures.

The package's import-time side effect is unrelated to its advertised assertion API and silently installs and executes another package with remote configuration. This is a concrete malicious execution chain, not an explicit user setup action.