MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)
Malicious package
Published
MAL-2026-10093 is a malicious package: @andrewstory18/is-real-odd (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10093/ (Markdown: https://insights.sbomify.com/MAL-2026-10093/index.md)
- Package
- @andrewstory18/is-real-odd
- Registry
- npm
What is MAL-2026-10093?
MAL-2026-10093 is a malicious package in @andrewstory18/is-real-odd, published on 9 Jul 2026.
Official description
@andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an additional obfuscated payload (index.min.js) wired into package.json as a postinstall script. The payload uses an _0x string-array dispatcher to hide its behavior; once deobfuscated, it issues an http.request POST to the hardcoded bare IP 144.172.91.84 on port 3000 at path /hello. This fires automatically on npm install, establishing an attacker-controlled callback from any installer machine and enabling tracking of successful infections and staging of follow-on payloads. The destination is unrelated to the legitimate is-odd publisher (jonschlinkert) and is not a registry, CDN, or known SDK endpoint.
What should I do about MAL-2026-10093?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.