chai-plus@6.2.4

No blocking static signals were detected.

Consumer imports/requires chai-plus

Executes attacker-selected third-party code outside the advertised assertion-library scope.

Import-time global npm installation and spawned foreign command

Requiring the advertised assertion library invokes Bootstrap.execute() automatically. Bootstrap checks for taskforge-9xv globally, installs taskforge-9xv@1.3.0 with npm if absent, then spawns its executable with an embedded external origin argument. This is concealed behind misleading comments claiming it is user-invoked despite the import-time call, enabling execution of unrelated package-controlled code on consumer machines.

This is concrete, unconsented import-time execution that globally installs and runs an unrelated package with an external endpoint. Absence of an npm lifecycle hook does not mitigate the runtime-import execution path.