@andrewstory18/is-real-odd is a malicious npm package that impersonates the widely-used is-odd package by duplicating its README, author, and repository metadata. It contains an obfuscated payload (index.min.js) triggered by a postinstall script defined in package.json. When installed, this payload sends an HTTP POST request to the IP 144.172.91.84 on port 3000 at path /hello, establishing a callback to the attacker's server. This behavior enables the attacker to track installations and potentially stage further malicious payloads. The destination IP is unrelated to the legitimate package publisher and is not a known registry or CDN endpoint. The only affected version explicitly identified is 2.0.3.

Installation of version 2.0.3 of @andrewstory18/is-real-odd results in automatic execution of malicious code that contacts an attacker-controlled server. This compromises the security of the installer environment by enabling attacker tracking and potentially further payload delivery. The package impersonates a legitimate library, increasing the risk of inadvertent installation by developers.

No official patch or remediation is currently documented. Users should avoid installing @andrewstory18/is-real-odd version 2.0.3 and verify package authenticity before installation. Prefer the legitimate is-odd package published by jonschlinkert. Monitor for any updates from the package maintainer or npm security advisories for remediation guidance.