The emoji-prints-fancy npm package (version 5.6.4) masquerades as a colorized logger but includes malicious code in its dist/index.js file. Upon module load, it decrypts a hardcoded ciphertext using AES-256-CBC with a fixed passphrase, salt, and IV derived via pbkdf2Sync (sha1, 100000 iterations). The decrypted plaintext is then executed as a shell command via child_process.spawn with shell execution enabled and output suppressed. This execution path is invoked by a top-level _warmConfigCache() call and is obscured by multiple non-functional decoy helper functions. Any user installing and importing this package will unknowingly execute the concealed command on their system.

Any system that installs and imports emoji-prints-fancy version 5.6.4 will silently execute an attacker-controlled shell command with the privileges of the importing process. The output of this command is suppressed, making detection difficult. This can lead to arbitrary code execution, potentially compromising the host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or importing emoji-prints-fancy version 5.6.4. Consider removing this package from existing environments and replacing it with a trusted alternative.