Malicious code in -john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive movie-themed name was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package
- Ecosystems
- Attack vectors
- Affected entities
- -john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love
An npm package named "-john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love" was published to the npm registry containing malicious code. The package name appears designed to deceive users by mimicking a movie title in Spanish, a common typosquatting and social engineering tactic.\n\nThe malicious package was identified and documented by the OpenSSF malicious packages project (MAL-2024-1682). The incident was disclosed via GitHub Security Advisory GHSA-rpgv-hp7p-qw89 on July 25, 2026.\n\nNo specific technical details about the malicious payload are provided in the source material, but the package was flagged as critical severity by the source feed.
Indicators of compromise
- Packages
- -john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love
Remediation
- Remove the package from npm if still available
- Audit npm dependencies for the presence of this package
- Review package.json and lock files for any references to this package
- If installed, remove from node_modules and reinstall clean dependencies
- Monitor systems that may have executed code from this package for signs of compromise
Sources
- GitHub Advisory GHSA-rpgv-hp7p-qw89 · GitHub Advisory Database
Cite this entry
"Malicious code in -john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-1mqqey
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in fetch-runtime
Malware was discovered in the npm package fetch-runtime. Any system with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malicious code in ghazaly (npm)
The npm package ghazaly version 99.9.0 contained malicious code that executed a postinstall hook to collect system information (hostname, current user, IP addresses) and exfiltrate it to a Burp Collaborator domain. The package exhibited dependency-confusion characteristics with a high version number and nonsense dependencies.
npmCompromised packageDependency confusion - containedcritical
Malicious code in base65-13x (npm)
base65-13x@5.0.2 on npm contains malicious obfuscated code disguised as a legitimate base-x library. The decode() function executes a ~123KB VM-style payload with dynamic code construction and network I/O capabilities.
npmCompromised package - containedcritical
Malicious code in kit-vim-map (npm)
The npm package kit-vim-map contained malicious code that executes a remote-controlled Linux ELF binary on installation, providing the attacker with arbitrary RCE, persistence, and file exfiltration capabilities. The binary beacons to C2 server 217.60.77.63 and establishes persistence via systemd user units.
npmCompromised packageMalicious commit