Malicious code in express-ycsrf (npm)

The package express-ycsrf was found to contain malicious code...