The npm package 'express-middle' version 5.5.1 contains malicious code that executes remote code on the installer's machine during installation. The package declares a postinstall script that runs an obfuscated JavaScript file which contacts a hidden command-and-control server, decrypts a payload, writes it to disk, and executes it silently. The package does not provide any legitimate middleware functionality and is designed solely to enable remote code execution.