The npm package 'routing-controls' version 1.0.1 is a malicious clone of the popular 'routing-controllers' package. It contains a code path that reloads a stub file named 'lib.min.js' on every POST request, which currently only logs a message but structurally allows future versions to execute arbitrary code on POST requests. There is no evidence of active exploitation or credential theft in the current version, but the package poses a latent risk if updated maliciously. Removal is recommended due to the potential for full system compromise.