We found a malicious npm package express-cookie-parser impersonating the popular Express cookie-parser package. The README.md file for express-cookie-parser is

We found a malicious npm package express-cookie-parser impersonating the popular Express cookie-parser package. The README.md file for express-cookie-parser is a copy from the cookie-parser package. The malicious payload is in cookie-loader.min.js in the analyzed version 1.4.12. This an unique malicious npm sample that does not depend on pre or post install hooks. Instead, the payload is executed when a documented API from the malicious library is used by an affected application.