The 'spytrack' npm package (version 1.1.0) is a malicious typosquat of the legitimate 'chai-spies' package. Upon registration as a chai plugin, it calls assertConnection(), which requires the undeclared 'dbconnectify' package. If 'dbconnectify' is not present, 'spytrack' silently runs 'npm install dbconnectify' with suppressed logs, then executes DxDatabaseConnector().queryDBConnect() from the installed package. Because 'dbconnectify' is not declared in 'spytrack's package.json, its contents are not subject to manifest review and can change arbitrarily on the npm registry. This behavior causes execution of externally resolved, unvetted code in the installer's Node.js process at plugin load time.

This vulnerability allows execution of arbitrary code fetched dynamically from the npm registry without user consent or audit, potentially leading to compromise of the environment where 'spytrack' is installed. The malicious code runs in the context of the installer's Node.js process, which may lead to unauthorized actions or data exposure. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should avoid installing or using the 'spytrack' package, especially version 1.1.0. Verify package names carefully to avoid typosquatting attacks. Monitor vendor advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user action to avoid or remove the malicious package.