L3 · Shartednpm · screenshot-desktop · malwarescreenshot-desktop-malware

GitHub flags screenshot-desktop 1.16.0 as malware and advises host recovery

GitHub’s malware advisory flags exactly screenshot-desktop 1.16.0 and lists no patched version. It advises treating hosts that installed or ran it as compromised and rotating secrets from another computer. npm currently points latest to 1.15.8; that does not clean existing hosts or prove other releases safe.

Disclosed: Nov 4, 2026; Public disclosure date
Severity: Sharted; 1 CVE tracked here
Splash zone: Developer machines, CI runners and applications that installed or ran npm screenshot-desktop 1.16.0.; node
In the wild: Unknown; GitHub flags malware; actual victim execution and theft remain unquantified.

What happened

GitHub’s November 4 advisory classifies screenshot-desktop 1.16.0 as malware. It does not identify a payload, exfiltration destination, attacker, maintainer-account takeover, confirmed victim or stolen-data total. Do not convert a registry malware warning into a claim that every user of the package was infected or that the broader npm platform was compromised.

The npm time record dates 1.16.0 to November 4 at 11:26:36 UTC, and GitHub published its advisory at 12:51:58 UTC. The currently observed latest tag points to 1.15.8. Neither that tag nor removal of the flagged release repairs a host that installed it. GitHub lists no patched release and explicitly warns that uninstalling the package may leave other malware behind.

L3 reflects malicious distribution through an established development dependency. npm reports 66,054 package downloads for October 28–November 3, a period before 1.16.0 existed; that is background reach, not an affected-host count. The advisory does not establish actual execution or theft on a particular machine, and no exploit payload was executed for this report. Inventory exact versions, preserve evidence, rotate from a clean computer and rebuild suspected hosts.

What’s in the bowl

GHSA-q2mc-9hgr-vmx2

Malware in screenshot-desktop 1.16.0

GitHub flags exactly version 1.16.0, with no patched version, and warns that removal alone cannot undo possible host control.

Fixed versions

Product	Safe from	Note
screenshot-desktop 1.16.0	No fix	Malicious release; no patched version listed

Crime-scene timeline

Nov 4, 11:26 UTC
npm records publication of version 1.16.0
The registry time record gives 11:26:36 UTC; this records publication, not confirmed installation or a known attack start.
Nov 4, 12:51 UTC
GitHub publishes the malware advisory
The original advisory API gives 12:51:58 UTC, flags exactly 1.16.0 and advises clean-device secret rotation. The registry currently points latest to 1.15.8; this is not a security guarantee for that version.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

GitHub original malware advisoryPrimaryGitHub’s own malware classification of exactly 1.16.0; no patched version and host-compromise/clean-device rotation guidance. No victim count, payload details or attribution is published.
GitHub advisory API metadataPrimaryPublished November 4 12:51:58 UTC; confirms npm package and exact vulnerable range, with no withdrawn flag or patched release.
npm original package metadataPrimaryVersion 1.16.0 publication time 11:26:36 UTC; latest points to 1.15.8 when checked. Registry state does not establish host cleanup or safety of every other release.
npm official weekly download statisticsPrimary66,054 package downloads during October 28–November 3, before the flagged version’s publication. These are downloads, not users, malicious-version installations or victims.

Wipe guide

The wipe checklist

0 of 4 sheets used

Identify installations of exactly 1.16.0Inspect package-lock.json, npm-shrinkwrap.json, yarn.lock or pnpm-lock.yaml, dependency inventories, CI install logs and cached build artifacts for screenshot-desktop version 1.16.0, including transitive dependencies. Do not install or run the suspect version to test exposure. Absence from the current latest tag does not rule out an earlier install.
Isolate affected hosts and preserve evidenceStop affected jobs/applications and disconnect suspected hosts while retaining lockfiles, install/build logs and package artifacts for your security team. GitHub advises treating a host that installed or ran this release as fully compromised. Its readable advisory gives no payload-specific network or file indicators; no matching indicator is not proof of safety.
Revoke secrets from a separate clean computerInventory credentials present on the host, then revoke/reissue relevant registry, repository, cloud and application secrets and terminate exposed sessions at their issuers. Update dependent secret stores afterward. GitHub explicitly says to rotate from a different computer; replacing a token on the suspect host can expose the replacement.
Rebuild before returning the host to serviceRemove the flagged package and rebuild the host/runner and affected artifacts from trusted sources after investigation. Recreate a reviewed dependency lock and verify the package’s current advisory before restoring jobs. No patched version is listed; npm latest 1.15.8 is a registry state, not an independently established safe replacement. Package removal alone cannot guarantee all resulting malware is gone.