The prism-silq npm package version 1.0.1 includes a binding.gyp file that uses GYP command-expansion syntax (<!(...)) in its sources field. npm automatically runs node-gyp rebuild when a binding.gyp is present, which executes the embedded shell command during the configure step. This results in silent install-time code execution equivalent to a lifecycle hook running attacker-controlled code. This abuse of the native-addon build system is not a legitimate build configuration and leads to full compromise of any system installing the package.

Any system that installs prism-silq version 1.0.1 is at risk of full compromise due to automatic execution of attacker-controlled code during installation. This can lead to unauthorized access, data theft, and persistent malicious presence. All secrets and keys on the compromised system should be considered exposed and must be rotated from a different, secure machine. Removing the package alone may not remove all malicious software introduced by the installation.

No official patch or fix is currently available. Users should immediately remove prism-silq version 1.0.1 from their environments. Given the severity of the compromise, all credentials and secrets on affected systems should be rotated from a secure environment. Monitor for any signs of persistent compromise and consider rebuilding affected systems to ensure complete removal of malicious components.