Malicious code in -espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package named "-espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love" was published containing malicious code. The package was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and payload behavior
- Ecosystems
- Attack vectors
- Affected entities
- -espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love
An npm package with the name "-espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love" was published containing malicious code. The package appears to be a typosquatting or obfuscation attempt, using a long, nonsensical name combining Spanish language text with movie references.
The malicious package was identified and cataloged by the OpenSSF (Open Source Security Foundation) malicious packages project, which maintains a public registry of known malicious software supply chain incidents. The incident was assigned identifier MAL-2024-1679.
The package has been flagged as critical severity, indicating potential for significant harm to systems that installed it. Users who installed this package should remove it immediately and audit their systems for any unauthorized changes or data exfiltration.
Indicators of compromise
- Packages
- -espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love
Remediation
- Remove the package from all affected systems immediately
- Audit systems for any unauthorized changes, data access, or network connections that may have occurred while the package was installed
- Review npm package.json and lock files to identify if this package was installed as a dependency
- Monitor for any suspicious activity on systems that may have executed code from this package
- Update to a clean npm environment and reinstall legitimate dependencies from trusted sources
Sources
- GitHub Advisory GHSA-wmrv-2242-6h6h · GitHub Advisory Database
Cite this entry
"Malicious code in -espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-l-zpxi5j
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in -pem-misa (npm)
The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.
npmCompromised packageMalicious commit