Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive movie-themed name was published containing malicious code. The package was identified and documented by the OpenSSF malicious packages database.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and payload behavior
- Ecosystems
- Attack vectors
- Affected entities
- -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love
An npm package named "-john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love" was published containing malicious code. The package name appears designed to deceive users through typosquatting or social engineering, using a popular movie title in Spanish.
The malicious package was identified and credited to the OpenSSF's malicious packages tracking project (MAL-2024-1683). The incident was disclosed on July 25, 2026, via GitHub Security Advisories.
No specific technical details about the payload or attack mechanism are provided in the source material. The package has been flagged in the OpenSSF database, indicating it has been removed or marked as malicious in the npm ecosystem.
Indicators of compromise
- Packages
- -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love
Remediation
- Remove the package from any systems where it may have been installed
- Audit npm dependencies for this package name and similar typosquatting variants
- Review the OpenSSF malicious packages database for related indicators
- Implement package name validation and allowlisting policies in dependency management
- Monitor for similar deceptive package names using movie titles or other popular media
Sources
- GitHub Advisory GHSA-m2gv-98xh-r6h8 · GitHub Advisory Database
Cite this entry
"Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-cas-jx6kdc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
npmCompromised package - resolvedcritical
Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)
Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in -pem-misa (npm)
The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.
npmCompromised packageMalicious commit