OpenAI Codex npm package exfiltrates authentication tokens

A malicious npm package named codexui-android has been stealing OpenAI Codex authentication tokens from developers’ machines, exfiltrating them to a server that mimics Sentry [1]. The package, advertised as a remote web UI for Codex, records over 29,000 weekly downloads and remains publicly available on npm.

The attack does not rely on a typo‑squatted or abandoned package. Instead, the malicious code was injected into a legitimate‑looking version of the package about a month after its initial release, allowing the attacker to build trust before the payload went live. The compromised code reads the user’s ~/.codex/auth.json file—containing access, refresh, and ID tokens as well as the account ID—and sends the data to sentry.anyclaw.store [1]. Because the refresh token never expires, an attacker who captures it can impersonate the victim indefinitely, gaining persistent, silent access to any Codex‑enabled service.

The supply‑chain vector extends to Android apps. Researchers observed two apps—OpenClaw Codex Claude AI Agent (over 50,000 downloads) and Codex (more than 10,000 downloads)—that embed the npm package inside a PRoot sandbox. When a user signs into Codex within the app, the same exfiltration routine runs, reading the auth file from the sandbox and shipping the OAuth blob to the attacker’s endpoint [1]. The malicious behavior has been present since version 0.1.82 of the npm package.

The package author, listed on GitHub as “friuns” (Igor Levochkin), initially claimed loss of npm account access, then edited the comment to say an internal investigation was underway and that the offending code was being removed [1]. The author also asserted no credential data had been shared, despite the domain “anyclaw.store” appearing in their X profile and WHOIS records showing the domain was registered just two days after the first package version was uploaded [1].

These findings highlight a growing trend of threat actors targeting AI developer tools to harvest credentials and infiltrate software supply chains. While the specific version 0.133.0 of the OpenAI Codex CLI is not mentioned in the reports, the broader risk remains: any tool that caches tokens in plaintext files like ~/.codex/auth.json can become a high‑value target. Developers should treat these files as passwords, avoid committing them, and monitor for unexpected network traffic to suspicious endpoints.

The open question is how quickly the community can detect and remediate such supply‑chain compromises before attackers leverage stolen refresh tokens for long‑term abuse.