Malicious npm package dsh-screenshot-native — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-01
GitHub's advisory database published a malware advisory for the npm package dsh-screenshot-native, version 1.0.0, flagged as CWE-506 embedded malicious code. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor; secrets and keys on affected machines must be treated as stolen. The package has no fixed or patched versions, so removal is the only option, and removal alone cannot guarantee the malicious software is gone. Reach appears limited (~566 downloads/month), but anyone who installed it is affected. No CVE; advisory GHSA-6f53-8jrf-3x9j published 2026-11-01.
What to do
- Remove dsh-screenshot-native from all projects and machines immediately
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild or reimage affected machines; do not assume removal fully cleans the system
- Audit dependency lockfiles and CI environments for the package
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
