Malicious npm Packages Target Developer Credentials

Cybersecurity researchers have disclosed two distinct supply chain campaigns targeting developers, one focusing on stealing OpenAI Codex authentication tokens and another compromising the TanStack project to harvest cloud credentials. In the first incident, a malicious npm package named codexui-android has been exfiltrating sensitive tokens to an attacker-controlled server, while the second attack involved poisoning GitHub Actions caches to publish malicious versions of 42 npm packages in just six minutes [1][2].

Key takeaways

• The codexui-android npm package has stolen OpenAI Codex refresh tokens, which do not expire, allowing for indefinite account impersonation [1].
• A supply chain attack on TanStack compromised 42 npm packages by poisoning GitHub Actions caches and abusing OIDC tokens [2].