A popular npm package for OpenAI Codex, racking up roughly 29,000 weekly downloads, has been caught stealing developer authentication tokens for over a month. The same credential-theft operation also ran through two Android apps that collectively amassed over 60,000 downloads.
On the surface, the package — codexui-android — looked completely legitimate. It had an active GitHub repository, real development history, and a healthy download count. For developers using OpenAI Codex, it delivered exactly what it promised: a remote web UI for the AI coding tool.
But for the past month, every invocation of that package silently read the user’s Codex authentication file and forwarded it to an attacker-controlled server. The stolen data included access tokens, refresh tokens, ID tokens, and account IDs — everything needed to impersonate the developer indefinitely.
As Aikido Security researcher Charlie Eriksen noted: “The refresh_token doesn’t expire. An attacker holding it can silently impersonate you indefinitely.”
How the Attack Worked
This wasn’t your typical supply chain compromise. Instead of relying on typosquatting or disposable throwaway packages, codexui-android was a fully functional tool under active development. Its GitHub repository remained clean. The malicious code existed only in the npm build artifact.
The package extracts the contents of Codex’s ~/.codex/auth.json file — a plaintext credential cache created whenever a user logs in through the Codex app, CLI, or IDE extension. It then sends these credentials to sentry.anyclaw[.]store, a server name chosen specifically to mimic Sentry, the legitimate error-tracking platform.
The malicious behavior was introduced roughly a month after the package was first published — a deliberately patient tactic designed to build user trust before deploying the payload. WHOIS records show the exfiltration domain was registered on April 12, 2026, just two days before the malicious code appeared.
What Developers Should Do
If you’ve used this package, assume your credentials are compromised. Revoke your OpenAI Codex tokens immediately, rotate any API keys that may have been exposed, and audit your accounts for unauthorized access. This incident serves as a stark reminder that even well-maintained, popular packages can harbor hidden threats — and that trust in open-source ecosystems should always be paired with vigilance.
