The npm package set-cookie-ease version 1.1.5 is a malicious typosquatting package masquerading as the legitimate js-cookie library. It contains code that executes arbitrary attacker-controlled JavaScript in Node.js or server-side rendering environments when Cookies.set is called with expires set to 0 or when document is undefined. This leads to remote code execution (RCE) with full host privileges. The package adds unexpected dependencies (axios and request) to support this behavior, despite advertising no dependencies. There is no official patch or remediation available at this time.