Malicious code in node-box-config (npm)

The package node-box-config was found to contain malicious code...