Why does socket.dev report that the latest version of next.js has a malware dependency? socket.dev/npm/package/...

“Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

Known malware: This package is malware. We have asked the package registry to remove it. Found 1 instance in 1 package