Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol (npm)

A malicious npm package named "-john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol" was published containing malicious code. The package was identified and documented by the OpenSSF malicious packages project.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on installation count of the malicious package
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanolnpm package containing malicious code

An npm package with the name "-john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol" was identified as containing malicious code. The package name appears to be a typosquatting attempt using a movie title to disguise its malicious intent.

The incident was documented by the OpenSSF (Open Source Security Foundation) as part of their malicious packages tracking effort (MAL-2024-1684). The advisory was published on GitHub on 2026-07-25.

The package has been flagged in the npm ecosystem and users who installed this package should take immediate action to remove it and audit their systems for any compromise.

Indicators of compromise

Packages
  • -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol

Remediation

  • Remove the malicious package from all systems where it was installed
  • Audit systems for any artifacts or changes introduced by the malicious package
  • Review npm package installation logs to identify affected projects
  • Update dependency management to prevent installation of similarly named packages
  • Monitor for any suspicious activity on systems that may have executed code from this package

Sources

  1. GitHub Advisory GHSA-pq9x-phc3-prr4 · GitHub Advisory Database

Cite this entry

"Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-cas-32x543

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.

    npmCompromised package
  2. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)

    A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.

    npmCompromised package
  3. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.

    npmCompromised package
  4. containedcritical

    Malicious code in -pem-misa (npm)

    The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.

    npmCompromised packageMalicious commit