Malicious code in heading (npm)

The package heading was found to contain malicious code...