LWA-2026-12308 confirmed malware
@andrewstory18/is-real-odd@2.0.2
Malicious code in @andrewstory18/is-real-odd (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScript
Analysis
@andrewstory18/is-real-odd is a scoped combosquat of the legitimate is-odd package. Its package.json declares a postinstall lifecycle hook that runs `node index.min.js`, executing a minified JavaScript payload on install. The referenced index.min.js payload file is absent from the published tarball in this version, so the payload did not ship here, but the install-time hook is present and designed to run a bundled minified script.
- analyzed by
- Leitwacht
- first seen
- Sep 21, 2026, 06:47 PM
- analyzed
- Sep 21, 2026, 06:48 PM
Related advisories
- @uh-platform/domain-widget@100.0.0
- @artistanbul/mta-frontend-footer@1.1.0
- lynxog@4.0.0
- chat-adapter-matrix@99.99.99
- @baanx/abis@9.9.9
- @baanx/blockchain-config@9.9.9
- @baanx/domain@9.9.9
- @baanx/common@9.9.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.