Malicious code in syncsub (npm)

The package syncsub was found to contain malicious code...