Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love (npm)

Malicious code was published in the npm package "-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love". The package was identified by the OpenSSF malicious-packages project and reported via GitHub Advisory GHSA-7x55-g6gw-jq49.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of the malicious package versions
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love

The npm package "-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love" was found to contain malicious code. This discovery was credited to the OpenSSF's malicious-packages project, which maintains a catalog of known malicious software supply chain incidents.

The package was cataloged under the identifier MAL-2024-1689 in the OpenSSF's malicious-packages repository. The advisory was published on 2026-07-25 and assigned GitHub Advisory identifier GHSA-7x55-g6gw-jq49.

No specific technical details about the malicious payload, affected versions, or remediation steps beyond package removal are provided in the source material.

Indicators of compromise

Packages
  • -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love

Remediation

  • Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.

Sources

  1. GitHub Advisory GHSA-7x55-g6gw-jq49 · GitHub Advisory Database

Cite this entry

"Malicious code in -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love-npm-1wicew

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.

    npmCompromised package
  2. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)

    A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.

    npmCompromised package
  3. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.

    npmCompromised package
  4. containedcritical

    Malicious code in -pem-misa (npm)

    The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.

    npmCompromised packageMalicious commit