The hexo-deployer-wrangler npm package version 1.0.4 includes a binding.gyp file that exploits the node-gyp rebuild process triggered implicitly by npm when binding.gyp is present. The file contains GYP command-expansion syntax (`<!(...)`) in the targets/sources fields, which executes shell commands during configuration. Since the package lacks native source files, the binding.gyp's purpose is solely to run malicious shell commands, enabling arbitrary code execution on the installer's machine during npm install. The package name mimics legitimate hexo-deployer and Cloudflare wrangler tools to deceive users. This results in a supply chain compromise where any system installing this package is considered fully compromised.

Installing hexo-deployer-wrangler version 1.0.4 results in arbitrary code execution on the installer's machine during the npm install process. This can lead to full system compromise, including unauthorized access to secrets and keys stored on the system. The attacker may gain persistent control, and simply removing the package does not guarantee removal of all malicious artifacts.

No official patch or fix is currently available. Users should immediately remove the hexo-deployer-wrangler package version 1.0.4 from their systems. All secrets and keys stored on affected machines should be rotated from a secure, uncompromised environment. Avoid installing packages with suspicious or impersonating names and verify package authenticity before installation. Monitor vendor advisories for any updates or official remediation.