The npm package 'multer-express' version 2.1.1 is identified as malicious. Although no direct malicious code patterns or install-time hooks were found, the package is considered fully compromising any system where it is installed. Systems with this package should be treated as fully compromised, and all secrets and keys stored on them must be rotated from a separate, secure system. Removal of the package alone does not guarantee elimination of the compromise.