# OpenAI Codex npm package exfiltrates authentication tokens **Published:** 2026-05-21T17:11:07.000Z **Topic:** OpenAI **Sentiment:** neutral **Publisher:** TrendWatcher — https://www.trendwatcher.in/article/a63cb996-d314-4101-961e-db1ce40e13d2 OpenAI Codex npm package “codexui-android” pulls 29,000 weekly downloads and steals auth tokens, exposing a supply‑chain risk for developers. A malicious npm package named **codexui-android** has been stealing OpenAI Codex authentication tokens from developers’ machines, exfiltrating them to a server that mimics Sentry [1]. The package, advertised as a remote web UI for Codex, records over 29,000 weekly downloads and remains publicly available on npm. The attack does not rely on a typo‑squatted or abandoned package. Instead, the malicious code was injected into a legitimate‑looking version of the package about a month after its initial release, allowing the attacker to build trust before the payload went live. The compromised code reads the user’s `~/.codex/auth.json` file—containing access, refresh, and ID tokens as well as the account ID—and sends the data to `sentry.anyclaw.store` [1]. Because the refresh token never expires, an attacker who captures it can impersonate the victim indefinitely, gaining persistent, silent access to any Codex‑enabled service. The supply‑chain vector extends to Android apps. Researchers observed two apps—**OpenClaw Codex Claude AI Agent** (over 50,000 downloads) and **Codex** (more than 10,000 downloads)—that embed the npm package inside a PRoot sandbox. When a user signs into Codex within the app, the same exfiltration routine runs, reading the auth file from the sandbox and shipping the OAuth blob to the attacker’s endpoint [1]. The malicious behavior has been present since version 0.1.82 of the npm package. The package author, listed on GitHub as “friuns” (Igor Levochkin), initially claimed loss of npm account access, then edited the comment to say an internal investigation was underway and that the offending code was being removed [1]. The author also asserted no credential data had been shared, despite the domain “anyclaw.store” appearing in their X profile and WHOIS records showing the domain was registered just two days after the first package version was uploaded [1]. These findings highlight a growing trend of threat actors targeting AI developer tools to harvest credentials and infiltrate software supply chains. While the specific version 0.133.0 of the OpenAI Codex CLI is not mentioned in the reports, the broader risk remains: any tool that caches tokens in plaintext files like `~/.codex/auth.json` can become a high‑value target. Developers should treat these files as passwords, avoid committing them, and monitor for unexpected network traffic to suspicious endpoints. The open question is how quickly the community can detect and remediate such supply‑chain compromises before attackers leverage stolen refresh tokens for long‑term abuse. ## Sources 1. The Hacker News — [OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack](https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html) 2. Memeburn — [How to Build an Agentic Organization with OpenAI Codex, By Endava](https://memeburn.com/how-to-build-an-agentic-organization-with-openai-codex-by-endava/) --- Cite as: TrendWatcher, "OpenAI Codex npm package exfiltrates authentication tokens", https://www.trendwatcher.in/article/a63cb996-d314-4101-961e-db1ce40e13d2