MalwarePublished 9 Jul 2026

@andrewstory18/is-real-odd (npm) · Malicious Code

Affects @andrewstory18/is-real-oddSource GCVE Database

Malicious package : remove @andrewstory18/is-real-odd and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:00 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10093

What to do

Remove @andrewstory18/is-real-odd from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@andrewstory18/is-real-odd	Affected =2.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @andrewstory18/is-real-odd is a malicious impersonation of the legitimate is-odd package. It copies the legitimate package's metadata but includes an obfuscated payload executed via a postinstall script. This payload sends an HTTP POST request to a hardcoded attacker-controlled IP address upon installation, enabling tracking and potential follow-on attacks. The affected version is 2.0.3. No official patch or remediation guidance is provided.

Impact

Installation of version 2.0.3 of @andrewstory18/is-real-odd results in automatic execution of malicious code that contacts an attacker-controlled server. This compromises the security of the installer environment by enabling attacker tracking and potentially further payload delivery. The package impersonates a legitimate library, increasing the risk of inadvertent installation by developers.

Defensive guidance

Users should avoid installing @andrewstory18/is-real-odd version 2.0.3 and verify package authenticity before installation. Prefer the legitimate is-odd package published by jonschlinkert. Monitor for any updates from the package maintainer or npm security advisories for remediation guidance.

Summary

@andrewstory18/is-real-odd is a malicious npm package that impersonates the widely-used is-odd package by duplicating its README, author, and repository metadata. It contains an obfuscated payload (index.min.js) triggered by a postinstall script defined in package.json. When installed, this payload sends an HTTP POST request to the IP 144.172.91.84 on port 3000 at path /hello, establishing a callback to the attacker's server. This behavior enables the attacker to track installations and potentially stage further malicious payloads. The destination IP is unrelated to the legitimate package publisher and is not a known registry or CDN endpoint. The only affected version explicitly identified is 2.0.3.

References

npmjs.com/package/@andrewstory18/is-real-odd/v/2.0.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:00 UTC

Technical details

References

Community reviews