Supply chain · npm · High

Critical Malicious npm Package: '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love'

Threat Engine Auto-Feed · data current as of 2026-07-25

A critical severity malicious package, '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' (npm), has been identified. While download numbers are currently low, its presence indicates a potential supply-chain risk for any projects that may have inadvertently included it.

  • Package: npm / -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

A malicious package, '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' version 1.0.0, was published to the npm registry. The advisory confirms the presence of malicious code within this package.

How the attack works

This is a malicious package attack, where an attacker publishes a seemingly benign or typo-squatted package containing harmful code. When this package is integrated into a project's dependencies, the malicious code can execute during installation or runtime, potentially compromising the build environment or end-user systems.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull dependencies directly from public registries
  • Organizations with internal mirrors that have synced this package

Conditions that increase exposure

  • Projects with unpinned or broad dependency version ranges (e.g., 'latest', '^1.0.0')
  • Build systems that do not use lockfiles (e.g., package-lock.json, yarn.lock)
  • Developers or automated systems that manually install packages without prior vetting

Blast-radius scenarios

  • If installed, the malicious code could execute within the build environment, potentially leading to credential exfiltration or further system compromise.
  • Compromised developer workstations if the package was installed locally.
  • Potential for downstream impact on applications if the package was bundled into a deployed product.

What to do (defensive)

Detect

  • Scan project dependencies for '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' version 1.0.0.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your dependency tree.
  • Review npm lockfiles (package-lock.json, yarn.lock) for unexpected entries or changes.

Contain

  • Immediately quarantine any systems or environments found to have installed this package.
  • Block the specific package name and version ('-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love@1.0.0') at your network perimeter or package registry proxy.
  • Isolate build environments that may have pulled this dependency.

Remediate

  • Remove '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' from all project dependencies.
  • Update package lockfiles to explicitly exclude the malicious version.
  • Force-rebuild affected applications and redeploy after verifying dependency integrity.
  • Rotate credentials that may have been exposed in compromised build environments or developer machines.

Frontier verdict — High

Prioritize scanning and removal of this critical malicious npm package to mitigate potential supply-chain compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.