Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)
A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and payload behavior
- Ecosystems
- Attack vectors
- Affected entities
- -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love
An npm package named "-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love" was published to the npm registry containing malicious code. The package name appears designed to deceive users through typosquatting or keyword stuffing, using references to a popular movie title in Spanish.
The malicious package was identified and cataloged by the OpenSSF malicious packages project (reference MAL-2024-1691). The incident was disclosed via GitHub Security Advisory GHSA-h9c4-52xf-g5q2 on July 25, 2026.
No specific technical details about the payload or attack mechanism are provided in the advisory text, but the package has been flagged as containing malicious code and should be avoided.
Remediation
- Remove the package from any environments where it may have been installed
- Audit npm dependencies for the presence of this package or similar deceptive package names
- Review npm audit logs for any installations of this package
- Consider using npm package allow-lists or security scanning tools to prevent installation of malicious packages
Sources
- GitHub Advisory GHSA-h9c4-52xf-g5q2 · GitHub Advisory Database
Cite this entry
"Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-e-8gzt71
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package