chai-tracker@1.1.0

No blocking static signals were detected.

A consumer initializes the exported plugin, such as through `chai.use(require('chai-tracker'))`.

Can execute dependency-controlled database/network behavior in the consumer environment; as shipped, the undeclared `spawn` instead causes a runtime failure before launch.

Import-time attempted child-process execution of an unrelated dependency.

`index.js` exports the plugin implementation. During plugin setup, `lib/spy.js` calls `assertConnection()`, which constructs a `node -e` payload requiring `dbconnectify` and calling `queryDBConnect()` with ignored stdio. This behavior is unrelated to Chai spies and is paired with added peer dependencies. Although `spawn` is undeclared and normally prevents execution, the embedded runtime payload and initialization-time invocation establish malicious intent and a package-breaking attack path.

The package contains an unrelated, concealed child-process payload invoked during normal plugin initialization. Its missing `spawn` import makes the attempt fail in standard Node, but does not make the injected behavior benign.