
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
👆 This hero shot of heroshot.sh is taken by heroshot ⚡️
Like Heroshot? Share your story — X/Twitter · LinkedIn · Reddit ❤️
Your app changes constantly. New features, design tweaks, bug fixes. Meanwhile, the screenshots in your README and docs quietly become lies.
The manual fix is tedious: open browser, navigate, log in, screenshot, crop, save, commit. Now do that for every image. Now do it again next month.
Heroshot fixes this. Define your screenshots once - point and click, no CSS selectors. Style them with the visual editor, add annotations to highlight what matters, and regenerate everything with one command.
npx heroshot
First run opens a browser with a visual editor. Pick elements, adjust padding, style borders, edit text, and add annotations (arrows, rectangles, callouts). Screenshots land in heroshots/, config saves to .heroshot/config.json. Next run regenerates everything headlessly.
VitePress · Full guide
// .vitepress/config.ts
import { heroshot } from 'heroshot/plugins/vite';
export default defineConfig({ vite: { plugins: [heroshot()] } });
<script setup>
import { Heroshot } from 'heroshot/vue';
</script>
<Heroshot name="dashboard" alt="Dashboard" />
Docusaurus · Full guide
// docusaurus.config.js
plugins: [['heroshot/plugins/docusaurus', {}]];
import { Heroshot } from 'heroshot/docusaurus';
<Heroshot name="dashboard" alt="Dashboard" />;
MkDocs · Full guide
# mkdocs.yml
plugins:
- macros:
modules: [heroshot]
{{ heroshot("dashboard", "Dashboard overview") }}
One component/macro, all variants - light/dark mode switches automatically, responsive sizes via srcset.
![]() | ![]() |
![]() | ![]() |
![]() | ![]() |
6 screenshots from one config entry - always in sync with the live site.
| Documentation | heroshot.sh |
| Getting Started | Quick start guide |
| Configuration | Config options |
| CI/CD Setup | Automated updates |
| CLI Reference | All commands & flags |
Your suggestions and feedback are highly appreciated. Please feel free to start a discussion or create an issue to share your experience with the tool or to discuss a feature/issue.
If you find heroshot useful, saves you a lot of work, and lets you sleep much better, then consider supporting the project by any of the following means:
MIT
FAQs
Define your screenshots once, update them forever with one command
The npm package heroshot receives a total of 89 weekly downloads. As such, heroshot popularity was classified as not popular.
We found that heroshot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.