MAL-2026-10671

    Dashboard / Malicious Package / MAL-2026-10671

    MAL-2026-10671

    Published: 15 Jul 2026Last Modified: 15 Jul 2026

    Summary: Malicious code in spytrack (npm)

    Details: Source: amazon-inspector (72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b) spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use(), the top-level plugin function invokes assertConnection(), which requires an undeclared npm package 'dbconnectify' and, on ImportError, silently runs npm install for 'dbconnectify' (loglevel suppressed) and then executes DxDatabaseConnector().queryDBConnect(). The fetched package is not declared in package.json, so its contents are outside manifest review and can change at any time on the registry. The install-and-exec fires at plugin load in the installer's Node.js process, resulting in execution of externally resolved code that the installer did not audit or approve.

    References: https://www.npmjs.com/package/spytrack/v/1.1.0

    Affected packages

    Package

    Name: spytrack

    Purl: pkg:npm/spytrack

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0
    MAL-2026-10671 | CVE-DB