Malicious code in -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package
- Ecosystems
- Attack vectors
- Affected entities
- -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love
A malicious npm package named "-john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love" was published to the npm registry. The package name uses a deceptive naming strategy, incorporating movie-related keywords to evade detection and potentially trick developers into installing it.
The malicious code was identified and documented by the OpenSSF's malicious packages project (MAL-2024-1681). The package was classified as critical severity due to the presence of confirmed malicious code.
The incident has been resolved through identification and documentation by the OpenSSF, enabling the community to identify and avoid the malicious package.
Remediation
- Remove the malicious package from any projects where it may have been installed
- Audit npm dependencies for the presence of this package or similar deceptively-named packages
- Review npm audit logs and dependency trees for unexpected or unfamiliar package names
- Consider using npm package allow-lists or automated scanning tools to detect suspicious packages before installation
Sources
- GitHub Advisory GHSA-jc3p-p2vg-2f2m · GitHub Advisory Database
Cite this entry
"Malicious code in -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed January 1, 2024; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-gjrhy1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in -pem-misa (npm)
The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.
npmCompromised packageMalicious commit