Either in the deserialization function, before returning the user
passport.deserializeUser(function(id, done) {
getUser(id).then(function(user) {
user.whatever = 'you like';
return done(null, user);
});
});
or in an express middleware (before the router).
app.use(function(req, res, next) {
if(req.user) req.user.whatever = 'you like';
next();
});