express-session-kit@1.1.1

Analysis

express-session-kit is a combosquat package impersonating the real express-session middleware. On require(), it executes a C2 beacon in session/check.js that phones home to hxxp://check-server-state[.]vercel[.]app/server/v2 with a "bearrtoken" header. If the server responds with a 404 containing a "token" field, that value is executed as code via new Function("require", ...) — delivering arbitrary remote code into the installer's process. The index.js also spawns a detached child process to run the beacon persistently. The package fraudulently claims TJ Holowaychuk as author and references a non-existent github[.]com/expressjs/session-kit repository.