Malicious code in -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena- (npm)
Malicious code was published in an npm package with a deceptive name mimicking movie content. The package was identified and cataloged by the OpenSSF malicious packages database.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package
- Ecosystems
- Attack vectors
- Affected entities
- -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena-
A malicious npm package named "-accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena-" was published to the npm registry. The package name uses a deceptive naming scheme that appears designed to attract users searching for movie-related content, a common typosquatting and social engineering tactic.
The malicious package was identified and documented by the OpenSSF's malicious packages project (reference MAL-2024-1677), which maintains a public catalog of confirmed malicious packages across package ecosystems. The package was classified as critical severity.
The incident appears to have been contained through detection and removal from the registry. Users who installed this package should remove it and audit their systems for any artifacts or changes introduced by the malicious code.
Indicators of compromise
- Packages
- -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena-
Remediation
- Remove the package from all environments where it was installed
- Audit systems for any unauthorized changes or artifacts introduced by the malicious code
- Review npm package installation logs to identify affected projects
- Use npm audit to check for any remaining malicious dependencies
- Consider implementing package name validation and allowlisting policies to prevent installation of suspicious packages
Sources
- GitHub Advisory GHSA-2rfc-9xf5-fg8h · GitHub Advisory Database
Cite this entry
"Malicious code in -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena- (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-va-1ciciq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in -pem-misa (npm)
The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.
npmCompromised packageMalicious commit