The npm package express-session-timer versions 1.0.0, 1.0.1, 1.0.11, 1.0.13, 1.0.14, 1.0.15, and 1.0.16 contains malicious code that triggers destructive behavior immediately upon being imported. Approximately 18 seconds after requiring the module, it recursively deletes the <cwd>/src directory and forcibly terminates Node.js processes related to the current working directory. This destructive routine occurs without any user configuration or opt-in and is unrelated to the package's advertised functionality. The package also depends on express-timer pinned to a security-hold placeholder version, indicating prior takedown activity. No patch or remediation information is provided.