Malicious code in metal-js-client (npm)

The package metal-js-client was found to contain malicious code...