Malicious code in @andrewstory18/is-real-odd (npm)
@andrewstory18/is-real-odd is a malicious npm package that impersonates the legitimate is-odd package by copying its metadata, but includes an obfuscated postinstall script that exfiltrates data to a hardcoded attacker IP (144.172.91.84:3000) on installation.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed @andrewstory18/is-real-odd via npm
- Ecosystems
- Attack vectors
- Affected entities
- @andrewstory18/is-real-oddMalicious npm package impersonating is-odd
@andrewstory18/is-real-odd is a typosquatting attack targeting the widely-used is-odd npm package. The malicious package copies the README, author information, and repository metadata from the legitimate package to appear legitimate.
However, the package includes an additional obfuscated payload in index.min.js that is wired into package.json as a postinstall script. The obfuscated code uses string-array dispatching to hide its true behavior.
When executed during npm install, the payload issues an HTTP POST request to the hardcoded IP address 144.172.91.84 on port 3000 at the path /hello. This callback mechanism enables the attacker to track successful infections and stage follow-on payloads.
The destination IP is unrelated to the legitimate is-odd publisher (jonschlinkert) and does not correspond to any known registry, CDN, or legitimate SDK endpoint.
Indicators of compromise
- Packages
- @andrewstory18/is-real-odd
- IPs
- 144.172.91.84
Remediation
- Immediately uninstall @andrewstory18/is-real-odd from all systems
- Audit npm install logs to identify when the package was installed
- Assume any machine that installed this package has been compromised; review for unauthorized network connections to 144.172.91.84:3000
- Replace with the legitimate is-odd package (published by jonschlinkert)
- Review package.json and lock files to ensure only legitimate packages are listed
- Monitor for any follow-on payloads or suspicious activity on affected systems
Sources
- GitHub Advisory GHSA-7h72-59gf-g77p · GitHub Advisory Database
Cite this entry
"Malicious code in @andrewstory18/is-real-odd (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 26, 2026; last updated July 26, 2026. https://supplychainattack.org/incident/malicious-code-in-andrewstory18-is-real-odd-npm-10tdab
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-moment
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-moment, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-axios
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-axios, a typosquat variant. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-webpack
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-webpack, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - resolvedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-lodash
Malware was distributed via the npm package @gocortexio/npmgremlinbox-typosquat-lodash, a typosquat of lodash. Installation grants full system compromise and requires immediate remediation including credential rotation and package removal.
npmTyposquattingCompromised package