express-timer: an npm 'security helper' that self-destructs your src/

Most malicious npm packages steal; this one just deletes your source tree a minute after you install it — and its author fumbled their own online-banking password into the very same tarball.