Importing the main entry initializes the plugin and launches a detached background child process. That child loads an externally supplied dependency and invokes its database-connect operation; no endpoint is disclosed in this package.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Runtime import of chai-tracker / chai.use(plugin).
Impact
Unconsented background execution and delegated network-capable behavior through dbconnectify.
Mechanism
Import-time detached child-process execution of a latest peer dependency.
Attack narrative
The main entry imports lib/spy.js. During plugin setup, lib/spy.js unconditionally calls assertConnection(), which starts a detached Node process with hidden output. The child requires dbconnectify and invokes queryDBConnect(); package.json requests that dependency as latest. This behavior is unrelated to a Chai spy plugin and executes on ordinary import without user action.
Rationale
The import-time, detached execution of an unrelated unconstrained dependency is a concrete hidden execution chain, not normal testing-plugin behavior. Absence of an explicit URL does not mitigate the unconsented delegated connection attempt.
Evidence
index.jslib/spy.jspackage.json