Supply chain · npm · High

Malicious npm package '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' identified

Threat Engine Auto-Feed · data current as of 2026-07-25

A critical severity malicious package, '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home', has been identified in the npm ecosystem. This package poses a supply-chain risk to any environment where it is installed, potentially leading to unauthorized code execution or data exfiltration.

  • Package: npm / -whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' version 1.0.0 contains malicious code. This indicates an attempt to compromise systems that integrate this package into their development or production workflows.

How the attack works

This is a malicious package attack, where an attacker publishes a seemingly legitimate or typo-squatted package containing harmful code. When a developer or automated system installs this package, the malicious code is executed, potentially compromising the build environment, developer workstation, or deployed application.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unvetted or latest dependencies
  • Developers who might inadvertently install typo-squatted packages

Conditions that increase exposure

  • Projects that do not pin dependency versions or use lockfiles
  • Environments that do not scan third-party dependencies for known vulnerabilities or malicious indicators
  • Internal package mirrors that do not filter out known malicious packages

Blast-radius scenarios

  • If installed, the malicious package could execute arbitrary code on the build server or developer's machine, leading to system compromise.
  • Sensitive data or credentials could be exfiltrated from the compromised environment.
  • The attacker could gain a foothold within the organization's infrastructure, enabling further lateral movement or persistent access.

What to do (defensive)

Detect

  • Scan existing projects and dependency trees for the presence of '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' version 1.0.0.
  • Implement automated dependency scanning tools in CI/CD pipelines to identify known malicious packages.
  • Monitor network traffic for unusual outbound connections from build environments or applications that might indicate data exfiltration.

Contain

  • Immediately isolate any systems or environments found to have installed this malicious package.
  • Block the package from being downloaded from public registries at the network perimeter or within internal package managers.
  • Review and revoke any credentials that may have been exposed on compromised systems.

Remediate

  • Remove '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' from all projects and environments.
  • Update dependency management practices to pin versions and utilize lockfiles to prevent unexpected dependency updates.
  • Educate developers on the risks of typo-squatting and the importance of verifying package authenticity before installation.

Frontier verdict — High

Prioritize immediate detection and removal of this critical malicious npm package to prevent supply-chain compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.