Malicious code in json-soap-postcss-tectonic (npm)

The package json-soap-postcss-tectonic was found to contain malicious code...