Malicious code in winston-loopback-nodejs-bulma (npm)

The package winston-loopback-nodejs-bulma was found to contain malicious code...