The package is not a malware. Low confidence YARA matches on common crypto functions, project has many stars/forks.
No verification record available.
The package node-forge is not a malware. The YARA rules excessive_bitwise_math, unsigned_bitwise_math_excess, multi_decode_3 and very_high_entropy triggered on the package's files. These rules are low confidence and can be triggered by legitimate cryptographic code, especially in minified Javascript files. The project has a good number of stars and forks, indicating it is a popular and likely legitimate library.
