The npm package hexo-deployer-wrangler version 1.0.4 contains malicious code embedded in its binding.gyp file. This file uses GYP command-expansion syntax to execute arbitrary shell commands during the npm install process, effectively allowing code execution on the installer's machine. The package impersonates legitimate hexo-deployer and Cloudflare wrangler tooling, making it a supply chain attack vector. Installing this package can lead to full system compromise, requiring immediate removal and secret rotation.