Malicious code in new-reactive (npm)

The package new-reactive was found to contain malicious code...