The emojifancy-print npm package version 5.6.3 includes a supply-chain backdoor triggered at import time. The malicious code in dist/logger.js decrypts an embedded AES-256-CBC encrypted command using hardcoded passphrase, salt, and IV with PBKDF2-SHA1 (100,000 iterations). This decrypted command is executed via child_process.spawn with shell execution, detached process, and suppressed output to evade detection. The rest of the code contains decoy functions and fake environment data to mislead analysis. This backdoor allows remote attacker-controlled shell command execution on any machine that installs and requires this package.

Systems with emojifancy-print version 5.6.3 installed and imported are fully compromised, as attacker-controlled shell commands run silently with the privileges of the importing process. This can lead to arbitrary code execution, data theft, persistence, and further system compromise. Because the backdoor triggers automatically on require, any use of the package results in immediate compromise. Secrets and keys stored on the affected system are at risk and should be considered exposed.

Remove the emojifancy-print package version 5.6.3 immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or accessible on compromised machines from a secure, unaffected environment. Because the backdoor executes at import time and may have allowed full system compromise, assume the system is untrusted and consider rebuilding or thoroughly investigating for additional persistence mechanisms. No official patch or fix is currently available; avoid using this package until a trustworthy version is released.