Malicious code in emoji-prints-fancy (npm)

The npm package emoji-prints-fancy was distributed with embedded malicious code designed to execute arbitrary shell commands on any system that installed and imported the package. The package advertised itself as a colorized logger but contained obfuscated payload logic.\n\nThe attack mechanism involved AES-256-CBC decryption of hardcoded ciphertext using a hardcoded passphrase, salt, and IV (with pbkdf2Sync using sha1 and 100,000 iterations). The decrypted plaintext was then passed to child_process.spawn with shell execution enabled (shell: true) and output suppressed (stdio: 'ignore').\n\nThe malicious code path was invoked automatically at module load time through a _warmConfigCache() call, ensuring execution occurred silently whenever the package was required or imported. Multiple decoy helper functions (_checkResources, _registerToken, _semverCompare, _emitEvent, _poolBucket) were included to obscure the actual payload and complicate static analysis.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14298).