chai-as-spy@1.2.6

Analysis

chai-as-spy@1.2.6 is a trojanized clone of the legitimate chai-as-spy Chai assertion plugin. The package injects two extra peerDependencies (gloggo and axios) that the genuine package does not declare, and lib/spy.js requires the gloggo module at load time, so the injected dependency executes whenever the package is imported. The bundled browser build (chai-as-spy.js) does not contain this require, confirming the injection targets the Node require path. Installers of this version pull and execute the injected gloggo dependency.