The hexo-shoka-swiper npm package version 0.1.10 includes a binding.gyp file that leverages GYP command-expansion syntax (<!(...)) to execute shell commands during the npm install process. Since npm automatically runs node-gyp rebuild when binding.gyp is present, this causes arbitrary shell code execution on the installer's machine without any declared install scripts. This behavior is malicious because the package's legitimate functionality as a front-end theme integration does not require native build steps or shell execution. The binding.gyp file is effectively used as a lifecycle hook to run arbitrary code, leading to full compromise of any system that installs this package.

Systems that install hexo-shoka-swiper version 0.1.10 are subject to arbitrary code execution during installation, resulting in full compromise of the affected computer. Attackers may gain complete control, potentially accessing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors, necessitating secret/key rotation and comprehensive incident response.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to immediately remove hexo-shoka-swiper version 0.1.10 from all systems. Additionally, all secrets and keys stored on affected machines should be rotated from a secure, uncompromised environment. Due to the potential for persistent compromise, further forensic analysis and remediation may be required. Avoid installing this package and audit dependencies to prevent inclusion of this malicious version.