Malicious code in node-winston (npm)

The package node-winston was found to contain malicious code...