express-session-js version 1.0.0 is a malicious npm package that impersonates the legitimate express-session package. Its initPlugin() function downloads and executes remote code controlled by an attacker via new Function.constructor() during startup, effectively allowing full compromise of any system running it. This package is identified as malware and poses a severe risk to confidentiality and system integrity. No patch or fix is available, and the threat is not a vulnerability in legitimate software but a malicious package distribution.

Any computer with express-session-js version 1.0.0 installed or running should be considered fully compromised. Attackers may have executed arbitrary code with full control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated from a different, uncompromised machine. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the express-session-js package immediately. Consider the affected system fully compromised and perform a thorough incident response, including rotating all secrets and keys from a separate trusted environment. There is no official patch or fix since this is a malicious package impersonation. Prevention includes verifying package authenticity before installation.