The npm package hexo-shoka-swiper version 0.1.10 contains malicious code embedded in its binding.gyp file. This file uses GYP command-expansion syntax to execute arbitrary shell commands during installation via npm, leading to automatic execution of malicious code on the installer's machine. The package's intended function as a Hexo theme Swiper integration does not justify such behavior, indicating deliberate misuse of the build process to run unauthorized code. Installing this package can result in full system compromise, requiring immediate secret and key rotation and removal of the package, though complete remediation is not guaranteed due to potential persistent compromise.