What does the express-timer malware do?

express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent harm mechanisms fire on install or load: 1. Postinstall backdoor injection (scripts/inject.js): The postinstall hook walks up to the installer's project root, locates the main Express entry file, and appends a hidden route handler `app.get('/robots.txt', (req, res) => { if (req.query.verify === 'destroy') { _boom();... } })`. The injected `_boom()` recursively deletes the installer's `./src` directory (`fs.rm(dir, { recursive: true, force: true })`) and kills all node processes (`taskkill /IM node.exe /F` on Windows, `pkill -f "node.* "` on Unix). Any remote actor who

Which versions of express-timer are malicious?

The following npm versions of express-timer are flagged malicious: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6. Treat any of these as compromised.

How do I remediate express-timer if I installed it?

express-timer is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed express-timer — how do I know if it already compromised me?

If express-timer was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is express-timer part of a known attack campaign?

Yes — express-timer is associated with the IN-MAL-2026-005395, IN-MAL-2026-005392, IN-MAL-2026-005394, IN-MAL-2026-005393, IN-MAL-2026-005391, IN-MAL-2026-005390 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find express-timer across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for express-timer (6 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging express-timer across your stack and pipelines.

Malicious package

express-timernpm

express-timer is a confirmed malicious npm package (MAL-2026-5555) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.1, 1.0.2, 1.0.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in express-timer (npm)

MAL-2026-5555

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall express-timer

What this malware does

express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent harm mechanisms fire on install or load:

Postinstall backdoor injection (scripts/inject.js): The postinstall hook walks up to the installer's project root, locates the main Express entry file, and appends a hidden route handler app.get('/robots.txt', (req, res) => { if (req.query.verify === 'destroy') { _boom();... } }). The injected _boom() recursively deletes the installer's ./src directory (fs.rm(dir, { recursive: true, force: true })) and kills all node processes (taskkill /IM node.exe /F on Windows, pkill -f "node.*<cwd>" on Unix). Any remote actor who hits GET /robots.txt?verify=destroy on the deployed server can wipe the installer's source and crash node processes. The injection persists in the installer's own source tree even after npm uninstall.
Auto-scheduled destruction on require (index.js): package.json sets main: index.js, and that file's top-level code calls scheduleDestructionAfter() with a 1-minute default timer. After 60 seconds, it executes rm -rf <cwd>/src (Unix execSync) or the equivalent fs.rm on Windows, then kills node/PM2 processes. Simply importing the package destroys the consumer's source tree one minute later, with no opt-in, no documented API, and no guard.
Bundled bank-fraud tooling (ibbl_statment.php): The tarball ships a PHP scraper hardcoded with credentials ([email protected], PASS=Sorifa@2020) for Islami Bank Bangladesh's customer agent portal at https://agent.islamibankbd.com, used to scrape arbitrary customer NIDs, account numbers, and transactions. Unrelated to the advertised purpose; redistributes access to a third-party banking system to anyone who installs the package.

Supporting context: package.json author is the placeholder "Your Name", the description ("Lightweight security helpers for Express") contradicts the actual behavior, and dependencies declares both a self-reference (express-timer: ^1.0.0) and a revealing sibling express-self-destruct1.

Malicious versions

6 flagged

1.0.11.0.21.0.31.0.41.0.51.0.6

Indicators of compromise (SHA-256)

10e5427085b867032f1b16630f04e82e89945022633c39475f30c7855b0fe76f

6bc13771ab814ced3a28c13a753e6c12a6c1cf760883f034a5a02a867b4ffc8d

7c2b03ef5914ee50d649906c3c1607f9a02334a73b93da3f198ec936a43e4fa7

18332a53ad8e0030325aea1b7bbdc537a1ee4112d4ed73e464d5181369ee4509

19d2dea0d7ac642b1921e0ac1bab9fa5ac543437d783764952da75a4b1fba33b

5b4fd1651a86f29904cbafe5a1d50f51a3108413ce0fef61fd92cfc61dedc683

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for express-timer (6 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging express-timer across your stack and pipelines.
If you installed it — respond
express-timer is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If express-timer was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks express-timer before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. express-timer on npm has been identified as a malicious package (versions 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005395IN-MAL-2026-005392IN-MAL-2026-005394IN-MAL-2026-005393IN-MAL-2026-005391IN-MAL-2026-005390

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks express-timer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database