Malicious code in yyf-async (npm)

The package yyf-async was found to contain malicious code...