registry / Malware / spytrack

spytrack

This report shows the evidence for spytrack@1.1.0, the only known version.

OpenSSF/OSV Malicious Advisory

imported 4mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10671 confirms this npm version as malicious.

Advisory

MAL-2026-10671

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in spytrack (npm)

Details

spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use(), the top-level plugin function invokes assertConnection(), which requires an undeclared npm package 'dbconnectify' and, on ImportError, silently runs npm install for 'dbconnectify' (loglevel suppressed) and then executes DxDatabaseConnector().queryDBConnect(). The fetched package is not declared in package.json, so its contents are outside manifest review and can change at any time on the registry. The install-and-exec fires at plugin load in the installer's Node.js process, resulting in execution of externally resolved code that the installer did not audit or approve.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package contains a reachable hidden external-connector path and a silent runtime dependency-install attempt. Its likely failure by default prevents proof of an active malicious chain, but it is unsafe and warrants a warning.

Static reason

No blocking static signals were detected.

Trigger

A consumer registers the exported plugin with Chai.

Impact

May invoke externally supplied database-connection behavior outside the package's stated testing purpose.

Mechanism

Undeclared runtime require plus silent dependency-install fallback

AI rationale

Evidence

index.jslib/spy.jspackage.jsonchai-spies.jsrollup.config.js

Independent scan evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

`lib/spy.js` calls hidden `assertConnection()` during Chai plugin setup.
It loads undeclared `dbconnectify` and invokes `db.queryDBConnect()`.
Fallback attempts a silent, no-save runtime install of `dbconnectify`.
This database action is unrelated to documented spy/assertion behavior.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
No concrete URL, credential harvesting, filesystem mutation, or shell execution is present.
The fallback installer references undefined `npm()` and is caught, so it normally fails when `dbconnectify` is absent.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

WildcardDependency

scanned 4 file(s), 42.7 KB of source

Source & flagged code

1 flagged

lib/spy.jsView file

•Published source reference

High

Ai Review Evidence

`lib/spy.js` calls hidden `assertConnection()` during Chai plugin setup.

lib/spy.jsView on unpkg

Findings

4 High1 Medium1 Low

HighAi Review Evidencelib/spy.js

HighAi Review Evidence

MediumWildcard Dependency

LowScripts Present

Affected versions and remediation

This report applies to spytrack@1.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing spytrack@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-15 22:56:31.357Z (UTC).

Source advisory published: 2026-07-15 07:56:21.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.1.0latestshownMaliciousMalwareBlockPublishedJul 15, 2026, 7:35 AM

registry / Malware / spytrack

spytrack

This report shows the evidence for spytrack@1.1.0, the only known version.

OpenSSF/OSV Malicious Advisory

imported 4mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10671 confirms this npm version as malicious.

Advisory

MAL-2026-10671

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in spytrack (npm)

Details

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A consumer registers the exported plugin with Chai.

Impact

May invoke externally supplied database-connection behavior outside the package's stated testing purpose.

Mechanism

Undeclared runtime require plus silent dependency-install fallback

AI rationale

Evidence

index.jslib/spy.jspackage.jsonchai-spies.jsrollup.config.js

Independent scan evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

`lib/spy.js` calls hidden `assertConnection()` during Chai plugin setup.
It loads undeclared `dbconnectify` and invokes `db.queryDBConnect()`.
Fallback attempts a silent, no-save runtime install of `dbconnectify`.
This database action is unrelated to documented spy/assertion behavior.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
No concrete URL, credential harvesting, filesystem mutation, or shell execution is present.
The fallback installer references undefined `npm()` and is caught, so it normally fails when `dbconnectify` is absent.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

WildcardDependency

scanned 4 file(s), 42.7 KB of source

Source & flagged code

1 flagged

lib/spy.jsView file

•Published source reference

High

Ai Review Evidence

`lib/spy.js` calls hidden `assertConnection()` during Chai plugin setup.

lib/spy.jsView on unpkg

Findings

4 High1 Medium1 Low

HighAi Review Evidencelib/spy.js

HighAi Review Evidence

MediumWildcard Dependency

LowScripts Present

Affected versions and remediation

This report applies to spytrack@1.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing spytrack@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-15 22:56:31.357Z (UTC).

Source advisory published: 2026-07-15 07:56:21.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.1.0latestshownMaliciousMalwareBlockPublishedJul 15, 2026, 7:35 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages