The npm package 'express-router-engine' versions 3.6.5 through 3.6.8 contains malicious code that executes attacker-controlled payloads on the host machine. The package is heavily obfuscated to hide a command-and-control (C2) communication mechanism that downloads and runs encrypted code upon being required. The package name and description are inconsistent, indicating an attempt to masquerade as a legitimate routing framework. Any user installing or requiring this package risks executing arbitrary malicious code.