The hardware is quite simple - it's a microcontroller connected to a piezoelectric speaker and a battery. In this case, the controller is the ATTiny9, which comes as a SOT23-6. It's connected to a 12MM coin cell battery bail and a 12.5mm piezo element. There's also a TPI interface on the board for updating the firmware.
Where this project gets complex is the firmware. A CR1225 has just under 50 mAh of power and you want to have the controller use as little of that as possible most of the time. If you clock the Tiny9 at 500 kHz then the idle consumption is something like 15 µA, which means that this project, in principle, should be able to last around 4 months on a battery.
When the controller wakes up, it generates a quarter-second tone of one of 5 frequencies. It then sleeps for a random period of time between 30 and 60 minutes and does it again. The random time means that the prank's target can't anticipate it and be ready to listen for where it's coming from, which will make it that much harder to find.
The first cut of the circuit board is 3/4" square. On the bottom is the battery clip, and straddling that, the speaker. The top has everything else, but is mostly flat, facilitating the placement of a piece of foam or magnetic tape.