Malicious code in valid-sha256 (npm)

The package valid-sha256 was found to contain malicious code...