MalwarePublished 9 Sep 2026Updated 30 Sep 2026

express-session-timer (npm) · Malicious Code

Affects express-session-timerSource GCVE Database

Malicious package : remove express-session-timer and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16065

What to do

Remove express-session-timer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexpress-session-timer	Affected 1.0.0 – 1.0.16 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package express-session-timer versions 1.0.0, 1.0.1, 1.0.11, 1.0.13, 1.0.14, 1.0.15, and 1.0.16 contains malicious code that triggers destructive behavior immediately upon being imported. Approximately 18 seconds after requiring the module, it recursively deletes the <cwd>/src directory and forcibly terminates Node.js processes related to the current working directory. This destructive routine occurs without any user configuration or opt-in and is unrelated to the package's advertised functionality. The package also depends on express-timer pinned to a security-hold placeholder version, indicating prior takedown activity. No patch or remediation information is provided.

Impact

The malicious code causes irreversible deletion of the source code directory under the current working directory and forcibly stops running Node.js processes related to that directory. This results in loss of source code and disruption of running services without user consent or warning. The impact is severe for any environment importing this package, as it can lead to significant downtime and data loss.

Defensive guidance

Users should immediately remove express-session-timer versions 1.0.0, 1.0.1, 1.0.11, 1.0.13, 1.0.14, 1.0.15, and 1.0.16 from their projects and avoid importing this package. Consider restoring affected source code from backups and verifying system integrity. Monitor for any unexpected process terminations or file deletions related to this package.

Summary

The express-session-timer npm package (versions 1.0.0, 1.0.1, 1.0.11, 1.0.13, 1.0.14, 1.0.15, and 1.0.16) contains embedded malicious code that schedules an unconditional destructive routine upon module load. About 18 seconds after import, it deletes the source directory at the current working directory's 'src' folder using fs.rm with recursive and force options, and then forcibly terminates Node.js processes associated with that directory using platform-specific commands (pkill on Unix, taskkill on Windows, and pm2 commands). This behavior is automatic, requires no configuration, and is unrelated to the package's intended functionality. The manifest pins a dependency to a security-hold placeholder package, suggesting the package was previously taken down or flagged.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:39 UTC

Technical details

References

Community reviews