The npm package @andrewstory18/is-real-odd is a malicious impersonation of the legitimate is-odd package. It copies the legitimate package's metadata but includes an obfuscated payload executed via a postinstall script. This payload sends an HTTP POST request to a hardcoded attacker-controlled IP address upon installation, enabling tracking and potential follow-on attacks. The affected version is 2.0.3. No official patch or remediation guidance is provided.