chai-tracker is a malicious npm package impersonating chai-spies by matching its name, README, and keywords. It declares peerDependencies on an attacker-controlled package dbconnectify pinned to 'latest' and axios. When a consumer calls chai.use(require('chai-tracker')), the exported plugin function invokes a helper named assertConnection(), which does not perform assertions but instead spawns a detached child process executing inline code that requires dbconnectify and calls a method on it. Because dbconnectify is attacker-controlled and unversioned, arbitrary code executes on the installer's host silently with stdio ignored. The malicious code is concealed within the chai Assertion method registration process.

Arbitrary code execution occurs on the host system at plugin load time, allowing attackers to run any code with the privileges of the user installing or running chai-tracker. The execution is silent and detached, making detection difficult. This can lead to compromise of the host environment, data theft, or further malicious activities.

No official patch or remediation is currently documented. Users should avoid installing or using the chai-tracker package. Audit dependencies carefully and verify package authenticity before use. Consider removing chai-tracker from projects and replacing it with legitimate alternatives such as chai-spies. Monitor for any unexpected child processes spawned by development tools.