Popular OpenAI Codex tool found stealing developer tokens

Post LinkedIn

🌍Read original on The Next Web (TNW)

#supply-chain-attack #cybersecurity #npm-securitycodexui-androidopenai codex npm

💡Critical security alert: A popular AI developer tool was compromised to steal API keys. Check your dependencies now.

⚡ 30-Second TL;DR

What Changed

The malicious package 'codexui-android' had 29,000 weekly downloads.

Why It Matters

This incident highlights the severe risks of supply chain attacks in the AI developer ecosystem. Developers relying on third-party npm packages for AI tool integration are now at risk of credential theft and unauthorized API usage.

What To Do Next

Immediately revoke any OpenAI API keys used in environments where 'codexui-android' was installed and audit your project's dependencies for suspicious packages.

Who should care:Developers & AI Engineers

Key Points

•The malicious package 'codexui-android' had 29,000 weekly downloads.
•The tool silently exfiltrated developer tokens while appearing as a legitimate remote UI.
•The supply chain attack persisted for at least one month before detection.

🧠 Deep Insight

Web-grounded analysis with 9 cited sources.

🔑 Enhanced Key Takeaways

•The malicious code was exclusively present in the published npm package, not in the public GitHub repository, making it undetectable through standard source code audits.
•The exfiltrated data included access_token, refresh_token, id_token, and account ID, with the refresh_token being particularly dangerous as it does not expire, granting attackers persistent and silent access.
•The attack extended to mobile users through two Android applications, 'OpenClaw Codex Claude AI Agent' and 'Codex,' published by 'BrutalStrike,' which automatically pulled and executed the malicious npm package at runtime.
•The attacker-controlled server, sentry.anyclaw.store, was deliberately named to mimic 'Sentry,' a legitimate application monitoring and error tracking platform, to evade detection of exfiltration traffic.
•The malicious functionality was introduced into the codexui-android package approximately one month after its initial publication, a tactic likely used to build user trust before deploying the payload.

🛠️ Technical Deep Dive

The malicious code was embedded within the dist-cli/index.js file of the codexui-android package, which imported a hidden script named chunk-PUR7OUAG.js that initiated the exfiltration.
The attack specifically targeted the ~/.codex/auth.json file, a plaintext credential cache where OpenAI Codex stores user login details, including OAuth tokens.
The stolen OAuth blob (containing access_token, refresh_token, id_token, and account ID) was XOR-encoded with the key "anyclaw2026", then base64-encoded, and finally transmitted to the attacker-controlled endpoint sentry.anyclaw.store/startlog.
The malicious functionality was active in codexui-android versions from 0.1.82 onwards.
For Android applications, the malicious npm package was installed and run within a Termux-derived Linux userland via PRoot, with the apps pulling codexui-android@latest to ensure the malicious version was always active.

🔮 Future ImplicationsAI analysis grounded in cited sources

AI developer tooling will become an increasingly high-value target for sophisticated supply chain attacks.

The incident demonstrates that powerful and long-lived tokens associated with AI tools make them attractive targets for persistent access to proprietary codebases, fine-tuning datasets, and API usage.

Software supply chain security measures will need to evolve beyond traditional source code audits to include runtime artifact verification.

The attack's success relied on malicious code being present only in the published npm package, not the public GitHub repository, highlighting a critical blind spot in source-focused security.

Developers and organizations will need to implement stricter credential rotation policies and enhance monitoring of AI account activity.

The exfiltration of non-expiring refresh tokens grants attackers indefinite access, necessitating proactive invalidation of sessions and rotation of credentials from known-clean machines.