LWA-2026-12308 confirmed malware

@andrewstory18/is-real-odd@2.0.2

Malicious code in @andrewstory18/is-real-odd (npm)

T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScript

Analysis

@andrewstory18/is-real-odd is a scoped combosquat of the legitimate is-odd package. Its package.json declares a postinstall lifecycle hook that runs `node index.min.js`, executing a minified JavaScript payload on install. The referenced index.min.js payload file is absent from the published tarball in this version, so the payload did not ship here, but the install-time hook is present and designed to run a bundled minified script.

analyzed by
Leitwacht
first seen
Sep 21, 2026, 06:47 PM
analyzed
Sep 21, 2026, 06:48 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.