Malicious npm package exfiltrates OpenAI Codex tokens
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- codexui-android npm package silently exfiltrates OpenAI Codex authentication tokens (access_token, refresh_token, id_token, account ID) from users' ~/.codex/auth.json files to the attacker‑controlled server sentry.anyclaw.store.
- Aikido Security researcher Charlie Eriksen disclosed that the malicious code was added about a month after the package’s initial release and has been active for every invocation since version 0.1.82.
- friuns (Igor Levochkin) is the npm account publishing codexui-android, which has attracted over 29,000 weekly downloads on npm while its GitHub repo appears clean.
- OpenClaw Codex Claude AI Agent Android app (package name gptos.intelligence.assistant) runs the codexui-android package inside a PRoot sandbox and forwards the same credential data to sentry.anyclaw.store.
- OpenAI warns that the auth.json file stores tokens in plaintext and that refresh tokens never expire, giving an attacker persistent, silent access to any Codex account.
Why it matters: Attackers gain persistent, silent access to Codex accounts, while developers lose credential security; with 29,000 weekly downloads, the breach lets hackers issue API calls and retrieve proprietary code.
