Malicious code in graphql-shorthand-parser2 (npm)

The package graphql-shorthand-parser2 was found to contain malicious code...