The npm package 'cookie-parser-es' version 1.0.7 is a malicious typosquatting package impersonating the popular 'cookie-parser' middleware. It copies metadata and author information from the legitimate package to deceive users. The package loads an undeclared dependency 'cookie-ease' at runtime, which executes code immediately when the middleware is used. Additionally, it declares a mutable dependency 'set-cookie-ease' pinned to 'latest', allowing the attacker to change the payload after initial scans. This behavior matches a supply-chain attack pattern designed to execute malicious code in dependent projects.