screenshot-desktop npm package 1.16.0 is malware — full machine compromise, no patched version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub published advisory GHSA-q2mc-9hgr-vmx2 on 2026-11-04 flagging version 1.16.0 of the popular npm package screenshot-desktop as malware (CWE-506, embedded malicious code). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists and the advisory is not accepting fixes. The package has ~217K monthly downloads, 215 dependent repositories, and 502 GitHub stars, so downstream projects and CI environments may be affected. Removal of the package does not guarantee removal of all malicious software planted during installation. Organisations should treat affected hosts as breached and rotate all secrets from a clean machine.
What to do
- Remove screenshot-desktop 1.16.0 from all projects, lockfiles and CI pipelines
- Rotate all secrets, keys and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild/reimage affected machines; do not assume uninstalling the package removed the malware
- Audit dependent repositories and downstream builds for use of the package and signs of compromise
- Pin to a known-clean version or replace the package with an alternative
Sources
All live incidents on Threat Watch
