chai-tracker@1.1.1

No blocking static signals were detected.

Application runtime when the exported Chai plugin function runs via `chai.use(require('chai-tracker'))`.

Executes externally supplied dependency code and may initiate an unsolicited database connection outside the package's spy functionality.

Hidden child-process execution of an injected database-connector dependency.

The Node entry exports `lib/spy.js`. When a consumer enables the plugin, module code calls `assertConnection()`, which silently spawns a second Node process that requires `dbconnectify` and invokes `queryDBConnect()`. The manifest adds `dbconnectify` as a peer dependency despite no legitimate spy feature needing it. This hidden runtime payload is absent from the browser bundle and is unrelated to Chai assertions.

The package contains a concrete, automatically triggered hidden child-process payload unrelated to its advertised testing functionality. The added dependency and suppressed child output reinforce malicious intent.