Malicious code in import-user-reject-decode-async (npm)

The package import-user-reject-decode-async was found to contain malicious code...