emojifancy-print@5.6.3

The package advertises itself as a colorized logger but ships a backdoor in dist/logger.js that fires automatically when the module is loaded. At require time, dist/index.js triggers logger.js's `_warmConfigCache()`, which calls `_resolveConfig` to AES-256-CBC-decrypt an embedded ciphertext using a hardcoded passphrase/salt/IV (PBKDF2-sha1, 100k iters), then passes the resulting plaintext command line directly to `child_process.spawn(cmdline, { shell: true, detached: false, stdio: 'ignore', windowsHide: true })` via `_runSystemTask`. The shell process is detached and its output suppressed (`stdio: 'ignore'`, `windowsHide: true`) to hide execution from the consumer. The rest of logger.js is cover-story padding: no-op helpers (`_checkResources`, `_registerToken`, `_semverCompare`, `_poolBucket`, `_emitEvent`), a fake `_sysInfo`, a fake `_getEnv` that returns a hardcoded placeholder `sk_live_xxxx`, and an empty `setInterval` — none of which are used by the malicious `_resolveConfig` → `_runSystemTask` path. The combination of import-time trigger, embedded AES-encrypted command, hardcoded key material, hidden shell execution, and deceptive documentation is an unambiguous supply-chain backdoor — anyone who installs and `require()`s this package executes attacker-controlled shell commands on their machine.