Taskade was founded in 2017 by John Xie, Stan Chang and Dionis Loire in response to their frustration with fragmented work that stifled creativity by necessitating multiple apps.
Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.