Critical Malicious Code Vulnerability in chatgpt-desktop-setup Package
Summary
MAL-2026-18056: Malicious code in chatgpt-desktop-setup (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chatgpt-desktop-setup package is an npm package designed for setting up a desktop application that utilizes OpenAI's ChatGPT. It allows users to interact with the AI in a user-friendly desktop environment. However, this package has been found to contain malicious code that compromises the security of any system it is installed on.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the chatgpt-desktop-setup package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The severity of this vulnerability is high, as it poses a significant risk to the integrity and confidentiality of user data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chatgpt-desktop-setupIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package and securing your system. It is crucial to monitor your system for any unusual activity after the package has been removed.
Conclusion
The chatgpt-desktop-setup package contains malicious code that poses a significant security risk. Users are advised to uninstall the package immediately and take steps to secure their systems. Regular monitoring for vulnerabilities is recommended to prevent future incidents.
See every vulnerability recorded for chatgpt-desktop-setup →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
Run the command 'npm uninstall chatgpt-desktop-setup' in your terminal to remove the package.
No, there is currently no patched version available for this package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities without requiring an account.
