This package should be immediately removed from the npm repository and the developer should be permanently banned from publishing npm packages.

If you purposely distribute malware you don't get to be part of the package registry as you have proven you can't handle the responsibility.