{
  "id": "screenshot-desktop-malware",
  "url": "https://ohshit.app/incidents/screenshot-desktop-malware/",
  "title": "GitHub flags screenshot-desktop 1.16.0 as malware and advises host recovery",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-04",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "npm",
    "screenshot-desktop",
    "malware"
  ],
  "ecosystems": [
    "node"
  ],
  "summary": "GitHub’s malware advisory flags exactly screenshot-desktop 1.16.0 and lists no patched version. It advises treating hosts that installed or ran it as compromised and rotating secrets from another computer. npm currently points latest to 1.15.8; that does not clean existing hosts or prove other releases safe.",
  "splash": "Developer machines, CI runners and applications that installed or ran npm screenshot-desktop 1.16.0.",
  "wipe": "Stop using 1.16.0, isolate affected hosts, rotate secrets from a clean device and rebuild from trusted sources.",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [
    {
      "id": "GHSA-q2mc-9hgr-vmx2",
      "name": "Malware in screenshot-desktop 1.16.0",
      "description": "GitHub flags exactly version 1.16.0, with no patched version, and warns that removal alone cannot undo possible host control."
    }
  ],
  "fixed": [
    {
      "product": "screenshot-desktop 1.16.0",
      "version": "none",
      "status": "Malicious release; no patched version listed"
    }
  ],
  "checklist": [
    {
      "title": "Identify installations of exactly 1.16.0",
      "hint": "Inspect package-lock.json, npm-shrinkwrap.json, yarn.lock or pnpm-lock.yaml, dependency inventories, CI install logs and cached build artifacts for screenshot-desktop version 1.16.0, including transitive dependencies. Do not install or run the suspect version to test exposure. Absence from the current latest tag does not rule out an earlier install."
    },
    {
      "title": "Isolate affected hosts and preserve evidence",
      "hint": "Stop affected jobs/applications and disconnect suspected hosts while retaining lockfiles, install/build logs and package artifacts for your security team. GitHub advises treating a host that installed or ran this release as fully compromised. Its readable advisory gives no payload-specific network or file indicators; no matching indicator is not proof of safety."
    },
    {
      "title": "Revoke secrets from a separate clean computer",
      "hint": "Inventory credentials present on the host, then revoke/reissue relevant registry, repository, cloud and application secrets and terminate exposed sessions at their issuers. Update dependent secret stores afterward. GitHub explicitly says to rotate from a different computer; replacing a token on the suspect host can expose the replacement."
    },
    {
      "title": "Rebuild before returning the host to service",
      "hint": "Remove the flagged package and rebuild the host/runner and affected artifacts from trusted sources after investigation. Recreate a reviewed dependency lock and verify the package’s current advisory before restoring jobs. No patched version is listed; npm latest 1.15.8 is a registry state, not an independently established safe replacement. Package removal alone cannot guarantee all resulting malware is gone."
    }
  ],
  "sources": [
    {
      "name": "GitHub original malware advisory",
      "url": "https://github.com/advisories/GHSA-q2mc-9hgr-vmx2",
      "says": "GitHub’s own malware classification of exactly 1.16.0; no patched version and host-compromise/clean-device rotation guidance. No victim count, payload details or attribution is published.",
      "primary": true
    },
    {
      "name": "GitHub advisory API metadata",
      "url": "https://api.github.com/advisories/GHSA-q2mc-9hgr-vmx2",
      "says": "Published November 4 12:51:58 UTC; confirms npm package and exact vulnerable range, with no withdrawn flag or patched release.",
      "primary": true
    },
    {
      "name": "npm original package metadata",
      "url": "https://registry.npmjs.org/screenshot-desktop",
      "says": "Version 1.16.0 publication time 11:26:36 UTC; latest points to 1.15.8 when checked. Registry state does not establish host cleanup or safety of every other release.",
      "primary": true
    },
    {
      "name": "npm official weekly download statistics",
      "url": "https://api.npmjs.org/downloads/point/2026-10-28:2026-11-03/screenshot-desktop",
      "says": "66,054 package downloads during October 28–November 3, before the flagged version’s publication. These are downloads, not users, malicious-version installations or victims.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "GitHub flags malware; actual victim execution and theft remain unquantified.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 4, 11:26 UTC",
      "title": "npm records publication of version 1.16.0",
      "body": "The registry time record gives 11:26:36 UTC; this records publication, not confirmed installation or a known attack start."
    },
    {
      "date": "Nov 4, 12:51 UTC",
      "title": "GitHub publishes the malware advisory",
      "body": "The original advisory API gives 12:51:58 UTC, flags exactly 1.16.0 and advises clean-device secret rotation. The registry currently points latest to 1.15.8; this is not a security guarantee for that version."
    }
  ],
  "body_markdown": "GitHub’s November 4 advisory classifies screenshot-desktop **1.16.0** as malware. It does not identify a payload, exfiltration destination, attacker, maintainer-account takeover, confirmed victim or stolen-data total. Do not convert a registry malware warning into a claim that every user of the package was infected or that the broader npm platform was compromised.\n\nThe npm time record dates 1.16.0 to November 4 at 11:26:36 UTC, and GitHub published its advisory at 12:51:58 UTC. The currently observed latest tag points to 1.15.8. Neither that tag nor removal of the flagged release repairs a host that installed it. GitHub lists no patched release and explicitly warns that uninstalling the package may leave other malware behind.\n\nL3 reflects malicious distribution through an established development dependency. npm reports 66,054 package downloads for October 28–November 3, a period **before** 1.16.0 existed; that is background reach, not an affected-host count. The advisory does not establish actual execution or theft on a particular machine, and no exploit payload was executed for this report. Inventory exact versions, preserve evidence, rotate from a clean computer and rebuild suspected hosts."
}