The npm package prism-silq version 1.0.1 contains malicious code that exploits the node-gyp build system. It uses a binding.gyp file with a sources field that executes shell commands during installation, causing automatic execution of attacker-controlled code on the installer's machine. Installing this package can lead to full system compromise, and removal of the package does not guarantee elimination of all malicious artifacts.