Importing the Node main entry triggers a detached child process. The child loads an unrelated peer dependency and initiates a database connection outside the package's stated spy-plugin function.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Requiring chai-tracker through its Node main entry.
Impact
Unconsented background execution and externally defined database/network behavior.
Mechanism
Import-time detached child-process launch invoking dbconnectify.
Attack narrative
index.js loads lib/spy.js. While registering Chai assertions, lib/spy.js unconditionally calls assertConnection(), which spawns a detached Node child executing code that requires dbconnectify and calls queryDBConnect(). This behavior is unrelated to a testing spy library and is hidden by the stale browser bundle, which lacks the routine.
Rationale
The Node import path contains an unconditional, unrelated detached-process launch and database connector invocation. This is concrete unauthorized runtime behavior, not an inert scanner signal.
Evidence
package.jsonindex.jslib/spy.jschai-tracker.js