A 46-year-old Italian was arrested immediately after the attack at Assago, on the outskirts of Milan, according to the ANSA news agency.
While the motive was unclear, media reports said police had ruled out any terrorism link.
The man grabbed a knife from a shelf in a Carrefour supermarket in the mall and started randomly attacking people, with at least four people hurt, reports said.
A “young supermarket employee… unfortunately lost his life as a result of the injuries received,” said Attilio Fontana, president of the Lombardy region, which includes Milan.
But he added that the other people injured “fortunately do not seem to be in life-threatening danger”, in a post on social media.
Fontana thanked employees, customers and police who “intervened to stop the madman”, as well as the medical staff who helped the victims.
Among those hurt was Mari, the Spanish defender for Monza football club, on loan from Arsenal.
Mari is to undergo surgery on Friday for injuries sustained during the attack, Serie A club Monza said.
The 29-year-old defender was hospitalised on Thursday night after being wounded in the back, but was conscious
and able to speak.
In a Tweet, North London club Arsenal said its thoughts were with Mari and the other victims, adding: “We have been in contact with Pablo’s agent who has told us he’s in hospital and is not seriously hurt”.
“Dear Pablo, we are all close to you and your family, we wish you well, keep fighting as you know how to do, you are a warrior and you will get well soon,” said Monza chief executive Adriano Galliani, in a message tweeted by the club.
Supermarket giant Carrefour confirmed the death of one of its employees in the attack in Assago
The company said it was “deeply saddened” at the news and offered its condolences to the families of the staff member killed, and the other victims.