@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-14
GitHub's malware advisory database published GHSA-7jf6-qwv2-qppp on 2026-11-14 flagging version 0.1.1 of the npm package @sfunction/dsh-screenshot as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; no patched version exists and no known source code is available. The package sees roughly 749 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove malicious software it may have installed. Affected users must rotate all secrets and keys from a clean machine and rebuild compromised systems.
What to do
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer
- Remove @sfunction/dsh-screenshot 0.1.1 from all projects and lockfiles
- Reimage or rebuild affected machines; do not assume removal cleans up the malware
- Audit systems for signs of compromise and unexpected outbound connections
- Block the package in internal registries and CI dependency checks
Sources
All live incidents on Threat Watch
