Malicious code in commander-js (npm)

The package commander-js was found to contain malicious code...