Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123 (npm)

Malicious code was published in the npm package "-whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123". The package was identified and cataloged by the OpenSSF malicious packages project.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on installation count of the malicious package.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123

A malicious npm package named "-whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123" was published to the npm registry. The package name appears to be a typosquatting attempt using a movie title to attract downloads.

The malicious package was identified and documented by the OpenSSF's malicious packages project (reference MAL-2024-1692). The package has been cataloged in the GitHub Advisory Database (GHSA-cjrq-9724-p6c3).

No specific details about the malicious payload or functionality are provided in the source material, but the package was flagged as containing malicious code and has been addressed through public disclosure and cataloging.

Indicators of compromise

Packages
  • -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123

Remediation

  • Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.

Sources

  1. GitHub Advisory GHSA-cjrq-9724-p6c3 · GitHub Advisory Database

Cite this entry

"Malicious code in -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 25, 2026; last updated July 25, 2026. https://supplychainattack.org/incident/malicious-code-in-whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-a-1nhi8i

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and documented by the OpenSSF malicious packages project.

    npmCompromised package
  2. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love (npm)

    A malicious npm package with a deceptive name containing movie-related keywords was published to the npm registry. The package contained malicious code and was identified by the OpenSSF malicious packages project.

    npmCompromised package
  3. resolvedcritical

    Malicious code in -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- (npm)

    Malicious code was published in an npm package with a deceptive name referencing a movie title. The package was identified and cataloged by the OpenSSF malicious packages database.

    npmCompromised package
  4. containedcritical

    Malicious code in -pem-misa (npm)

    The npm package -pem-misa contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages.

    npmCompromised packageMalicious commit